Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documentation-only helper for improving error messages, with somewhat broad activation wording but no hidden execution, data access, persistence, or privileged behavior.
This appears safe to install as a lightweight writing/workflow helper. Consider narrowing its activation phrases if your agent auto-invokes skills, because generic support or debugging requests could select it when a general assistant response would be better.
The skill description and activation guidance are broad enough to match many ordinary support, productivity, debugging, and feedback requests, which can cause the skill to be invoked outside its intended niche. Overbroad routing is dangerous because it may override a more appropriate skill, produce irrelevant instructions, or expand the skill's operational reach beyond what users expected.
The trigger sentence is so broad and close to ordinary user phrasing that the skill may activate unintentionally during routine conversations about help, workflows, or error messages. That can cause incorrect tool/skill selection, unexpected prompt routing, and increased exposure to downstream prompt-injection or data-handling risks if the skill is invoked when the user did not explicitly intend it.
The trigger sentence is phrased as a very general help request, which increases the chance the skill will activate during ordinary user conversations that merely mention needing help with error messages. Unintended activation can cause prompt-routing mistakes, invoke the wrong workflow, and interfere with expected system behavior, especially in agent environments where skills are selected automatically from natural language.
This trigger uses a generic request pattern ('I need a practical workflow for ...') that is broad enough to match many legitimate conversations outside the intended skill boundary. In an auto-dispatch system, that can produce accidental skill execution, misrouting, and reduced reliability, which becomes a security concern when the wrong skill gains access to user context or influences downstream actions.
The trigger phrases are broad, generic, and overlap with ordinary help requests like debugging, support, and workflow assistance. This can cause the skill to activate in contexts the user did not explicitly intend, increasing the chance of prompt hijacking, misrouting, or unintended use of the skill’s instructions over a general assistant response.
The keyword list uses generic terms like 'debugging', 'support', and 'troubleshooting' without qualifiers, making accidental or excessive activation likely. In agent systems, generic triggers can misroute user requests and cause unintended behavior selection, especially when multiple skills compete for common help-oriented prompts.
该文件为 SKILL.zh-CN.md，整体内容固定为简体中文地区化版本，但文档中未说明这是用户可选语言，也未给出仅适用于特定地区/受众的明确约束。按照语言/locale 政策，若技能隐含强制特定语言而没有用户选择或正当说明，属于自然语言策略风险。
The trigger keywords are broad, generic productivity and support terms that can overlap with many unrelated user requests. This can cause accidental invocation of the skill in contexts where the user did not intend error-message optimization, leading to misrouting, irrelevant guidance, or unexpected processing of user inputs.
The example trigger phrases begin with very general constructions like 'Help me' and 'I need a practical workflow for', which are common in ordinary conversation. If activation logic or downstream routing relies on these examples, the skill may be selected for unrelated requests, increasing the chance of incorrect task execution or user confusion.
The skill enables implicit invocation while its description and default prompt are broad and loosely scoped to general productivity, debugging, support, workflows, artifacts, and analysis tasks. This can cause the agent to invoke the skill in situations beyond narrowly intended error-message improvement, increasing the chance of unintended handling of sensitive user content or prompt-scope expansion through an overly permissive trigger surface.
This file is a Chinese-language README and does not indicate that users may choose their preferred language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
