Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for improving error messages, with no code execution or persistence, though its activation wording is broader than ideal.
Before installing, note that this skill may trigger on broad debugging or support phrasing. It appears safe from a security perspective, but users who want precise skill routing may prefer narrower activation wording focused only on improving user-facing error messages.
The skill description uses very broad activation language such as general productivity, debugging, support, workflows, analysis, and implementation help. This creates excessive overlap with ordinary user requests, increasing the chance the skill is invoked unintentionally and influences responses outside its narrowly intended scope.
The trigger keywords are too generic to safely distinguish this skill from normal assistance requests. Keywords like 'debugging', 'support', 'user feedback', and 'troubleshooting' are common across many domains, so the skill may be selected in unrelated contexts and override more appropriate routing or safety boundaries.
The trigger sentence is broad enough to match ordinary user phrasing such as generic requests for help or practical workflows, which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance of prompt/context hijacking at the routing layer, where the wrong skill may capture unrelated conversations and steer outputs in unintended ways.
The trigger phrases are generic and map to common support and debugging requests, which increases the chance the skill will activate in situations where the user did not explicitly intend to use it. Over-broad activation can cause inappropriate routing, prompt/context injection into unrelated workflows, or accidental exposure of sensitive troubleshooting data to a skill not specifically requested.
The trigger phrases are broad enough to match ordinary requests about productivity, debugging, support, and workflows, which can cause the skill to activate outside its intended scope. Over-broad activation increases prompt-surface exposure and can route unrelated user requests into this skill, creating opportunities for misapplication, confusion, or abuse in agent-selection pipelines.
The example trigger sentences use everyday phrasing that could match many normal requests without clearly signaling constrained activation. Because examples often shape invocation behavior, generic examples increase accidental routing and make the skill more likely to activate when the user did not actually request error-message refinement.
The activation description is overly broad because it says to use the skill for multiple generic categories like work-productivity, debugging, support, and user feedback without precise inclusion or exclusion criteria. In an automated skill-selection environment, ambiguous routing rules can cause the skill to capture unrelated prompts, leading to unintended behavior, reduced reliability, and possible interference with other more appropriate skills.
The trigger keywords are very broad and overlap with common support and productivity requests, so the skill may activate in many ordinary conversations where it was not specifically intended. This can cause misrouting, unnecessary invocation, or prompt/context hijacking of unrelated user tasks, especially in agent systems that auto-select skills based on keyword matches.
The default prompt is phrased very broadly and maps to common support and productivity language, which increases the chance of unintended activation during ordinary user conversations. In a system that supports skill routing, this can cause the agent to invoke this skill when the user did not explicitly request it, creating prompt-scope confusion and possibly exposing user context to an unnecessary skill path.
Enabling implicit invocation without tightly scoped trigger conditions allows the platform to auto-select this skill based on ambiguous user phrasing. That increases the risk of misrouting, unintended instruction injection into the conversation flow, and unnecessary access to user-provided context, especially because this skill's purpose overlaps with common debugging and support interactions.
This file is entirely presented in Chinese, but the text shown here does not state that the skill is region-specific or that users can choose another language. Under the language/locale policy, forcing a single language without opt-in can be a natural-language policy issue unless the locale limitation is explicitly justified.
The example trigger phrases are close to common everyday help requests, which reinforces ambiguous matching and teaches the router to associate broad language with this skill. While less severe than core routing logic, these examples can still bias selection systems toward over-triggering and degrade task isolation.
No suspicious patterns detected.
