Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small workflow guide for a specific UI enhancement and does not contain code, persistence, credential access, or hidden execution behavior.
Before installing, consider whether you want this skill to activate implicitly; its broad keywords may make it appear for loosely related account, filter, form, or enhancement requests. The inspected files otherwise show a purpose-aligned workflow guide with no executable behavior.
The skill description includes highly generic terms such as 'general-help', 'enhancement', and 'filter', which can match many unrelated user requests and cause unintended invocation. Over-broad activation increases the chance that this skill intercepts prompts outside its intended scope, leading to incorrect workflow application, prompt routing confusion, or misuse of downstream files and guidance.
The explicit trigger list is too broad to safely identify this skill because terms like 'account', 'filter', 'entry', and 'selected' are common across many benign conversations. This creates a prompt-selection vulnerability where the skill may activate in unrelated contexts, potentially overriding more appropriate skills or injecting irrelevant workflow steps into user interactions.
The default prompt includes broad, everyday trigger terms such as "help me" tied to a common enhancement workflow, which can cause the skill to be invoked in contexts the user did not clearly intend. Because implicit invocation is enabled, this ambiguity increases the chance of accidental activation and unintended exposure of the skill's behavior in unrelated conversations.
The skill declares an extremely broad audience ('maintainers and users asking for software improvements') and category ('general-help'), which can cause the agent to select this skill for loosely related or generic requests rather than the specific enhancement it is meant to address. Over-broad routing increases the chance of unintended invocation, irrelevant guidance, and prompt-surface expansion where adversarial or unrelated user input is funneled into a skill that was not meant to handle it.
The trigger sentences use common phrases like 'Help me' and 'I need a practical workflow' around the feature text, without strong boundaries that distinguish this skill from many ordinary support or enhancement requests. In an automated skill-selection system, such broad triggers can cause accidental activation, misrouting, and an attacker-friendly way to steer the agent into this workflow using generic language.
No suspicious patterns detected.
