Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for improving error messages, with broad activation wording but no hidden code, persistence, credential use, or destructive behavior.
Installers should know this skill may be invoked for broad support/debugging language because implicit invocation is enabled and the triggers are loose. Review or narrow the triggers if precise routing matters, especially in environments with many specialized skills.
The trigger phrases are generic enough to match many ordinary support or productivity requests, which can cause the skill to activate outside its intended scope. Over-broad activation is dangerous because it can override more appropriate skills or inject this workflow into unrelated conversations, increasing the chance of unintended behavior and user confusion.
The trigger phrases are broad, natural-language prompts that could match ordinary user requests and cause the skill to activate when the user did not explicitly intend to invoke it. In an agent ecosystem, unintended activation can route user data or workflow control into the wrong skill, creating confusion, privacy exposure, or unsafe task execution paths.
The skill description uses broad terms like work-productivity, debugging, user feedback, support, and implementation support, which can cause the skill to activate for many unrelated requests. Over-broad routing increases the chance of unintended invocation, leading to prompt-scope confusion, lower-quality handling, or accidental interception of tasks better handled by more specific skills.
The trigger keywords are highly generic and overlap with common conversational language used across many support interactions. This makes the skill easy to invoke outside its intended domain, which can degrade routing integrity and cause the agent to select this skill when a more appropriate, narrower skill should handle the request.
The example trigger phrases are written in broad, everyday language and closely mirror normal user requests, which can train or bias invocation systems toward over-selection. Because examples often strongly influence matching behavior, these generic phrases increase the risk of accidental activation for loosely related requests rather than the narrow error-message-improvement use case.
该技能文件以 SKILL.zh-CN.md 形式呈现，全文内容固定为简体中文，但文档中没有说明这是可选语言版本，也未向用户提供语言偏好选择。对于面向广泛用户群体的技能说明，默认强制单一语言/区域可能违反语言/locale 选择政策。
The trigger keywords are overly broad and include common terms like debugging, support, and user feedback, which can cause the skill to activate in unrelated conversations. This creates routing confusion and may override a more appropriate skill, leading to incorrect assistance, disclosure of irrelevant internal workflows, or degraded reliability of the agent system.
The default prompt is vague and broadly scoped, which can cause the agent to be invoked in situations beyond the intended error-message improvement use case. Because implicit invocation is enabled, this ambiguity increases the chance of unintended activation and over-collection or processing of user context that was not meant for this skill.
The trigger sentence is overly broad and matches common help-seeking language, which can cause the skill to activate in situations far beyond its intended scope. This increases the chance of unintended routing, prompt collisions with other skills, and user input being processed under the wrong workflow, which can degrade reliability and potentially expose sensitive troubleshooting context to an unnecessary skill path.
The file declares separate English and Chinese instruction and guide files, but does not state how language is selected or whether the user can choose their preferred locale. This can create a policy concern if the skill defaults to a language without explicit user opt-in.
This README is labeled as a Chinese-language document, but key user-facing content is presented in English, including requirement and workflow descriptions. That can effectively impose a language preference on users without opt-in or explanation, which conflicts with language/locale policy expectations.
Core instructional text such as the workflow description and trigger phrases are written in English even though the file is the zh-CN README. This may force a specific language for invocation and usage without giving users a localized alternative or explicit choice.
No suspicious patterns detected.
