Security audit
Security checks for vulnerabilities and agentic risk
This is a benign documentation-style skill for improving error messages, with some overly broad activation wording but no code execution, persistence, or sensitive data handling.
This skill is reasonable to install if you want help rewriting vague errors into clearer user-facing or support-facing guidance. Be aware that its broad implicit triggers may make it appear during general debugging or support requests; avoid sharing secrets, tokens, or private logs unless they are needed and redacted.
The trigger sentence begins with a very broad everyday phrase ('Help me ...'), which can cause the skill to activate in many unrelated user requests. Over-broad activation increases the chance of unintended invocation, causing prompt-routing mistakes and exposing users to irrelevant or lower-quality guidance when they did not ask for this specific skill.
The activation guidance does not define clear scope constraints or exclusion cases, so the orchestrator may invoke the skill for generic productivity, debugging, or support requests that are not actually about error-message improvement. In a multi-skill agent system, this ambiguity can lead to inappropriate tool selection, degraded safety controls, and unintended influence over unrelated tasks.
The trigger sentence is broad enough to match ordinary user phrasing about help, workflows, or support, which can cause the skill to activate outside its intended context. Over-broad activation increases the chance of prompt/skill hijacking at the routing layer, where this skill may intercept unrelated requests and steer outputs unexpectedly.
The trigger phrases are broad enough to match many ordinary requests about productivity, debugging, support, or feedback, which can cause the skill to activate outside its intended scope. In an agent environment, overbroad routing increases the chance that unrelated user requests are captured and handled by this skill, leading to confused delegation, prompt-scope creep, and potentially unsafe processing of sensitive troubleshooting content.
The skill description uses broad activation terms like work-productivity, debugging, user feedback, support, and practical workflow, which can cause the skill to be invoked for many generic requests beyond improving error messages. Over-broad routing increases the chance of unintended skill selection, producing irrelevant guidance or overshadowing a more appropriate skill, especially in automated dispatch systems.
The trigger keywords and example phrases are generic and weakly constrained, especially debugging, user feedback, support, and troubleshooting. In a skill-selection pipeline, these broad triggers can cause accidental invocation on commonplace requests, degrading routing integrity and potentially displacing specialized skills that should handle the task.
The trigger keywords are broad, generic terms like 'debugging', 'support', and 'user feedback' that commonly appear in ordinary conversations. This can cause the skill to activate outside its intended scope, leading to inappropriate routing, unexpected behavior, or prompt/context injection into unrelated tasks.
The example triggers use highly general natural-language requests and do not define boundaries for non-matching cases. Without negative examples or tighter scoping, downstream systems may over-match ordinary requests and invoke this skill in unrelated contexts, reducing reliability and increasing the chance of unsafe or confusing automation.
The manifest enables implicit invocation while describing the skill in very broad terms such as work-productivity, debugging, support, workflow, artifact, checklist, analysis, or implementation support. This can cause the orchestrator to invoke the skill in situations beyond its narrow purpose, increasing the chance of unintended data exposure or unsafe delegation based on loosely related user requests.
The trigger sentence is ambiguous because it requests a 'practical workflow' for a long requirement statement rather than clearly delimiting the skill's operational scope. Ambiguous triggers can match loosely related troubleshooting or productivity prompts, leading to accidental skill selection and unreliable behavior in multi-skill environments.
This file is presented as a Chinese-language README, but key user-facing descriptive text is written in English. That creates a locale inconsistency and may effectively force one language for some users without opt-in or explanation.
No suspicious patterns detected.
