Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for improving error messages, with some broad routing language but no hidden execution, persistence, or data access behavior.
Installers should understand that this skill may be invoked broadly around debugging, support, validation, or troubleshooting language. It is appropriate for rewriting user-facing error messages, but users should avoid feeding unnecessary secrets, stack traces, or sensitive logs unless that context is required and safe to share.
The trigger sentence begins with an overly broad everyday phrase ('Help me'), which can cause the skill to activate in many unrelated conversations. In an agent environment, broad triggers increase the chance of unintended routing, causing the model to apply this skill outside its intended scope and potentially override safer, more precise behaviors for other tasks.
This file is entirely written in Simplified Chinese and presents itself as the user guide without any in-file note that the language is optional or region-specific. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill description is very broad and overlaps with common debugging, support, validation, review, and documentation tasks, which increases the chance of accidental or unnecessary invocation. Over-broad activation can route unrelated user requests into this skill, causing prompt-scope confusion, inappropriate handling of sensitive troubleshooting content, or degraded security review quality when the skill is applied outside its intended niche.
The trigger keywords are generic terms like 'debugging', 'support', and 'validation', which are common across many unrelated workflows and can cause the skill to activate far beyond error-message rewriting. This ambiguity makes it easier for the skill to capture requests containing sensitive operational context or to interfere with more specialized skills that should handle diagnosis, security triage, or support policy decisions.
The description defines the usage scope too broadly by including multiple domains and broad support activities without clear gating conditions. In practice, this can over-expand routing so the skill may engage on general debugging or support tasks beyond error-message improvement, which raises the risk of inappropriate handling and prompt-surface expansion.
The trigger keywords are very broad and generic, covering common terms like error messages, debugging, support, validation, and troubleshooting. This can cause the skill to be invoked in many unrelated contexts, increasing the chance of misrouting user requests and applying this skill where a narrower or safer skill should handle the task.
The skill enables implicit invocation but provides only a broad description and a generic default prompt, with no narrow activation constraints. This can cause the agent to invoke the skill in unintended contexts and rewrite or transform error-related content automatically, which may mislead users, expose sensitive diagnostic text to unnecessary processing, or interfere with safer task routing.
