Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only housing dispute planning skill with broad activation wording and weak demand evidence, but no hidden code, persistence, credential access, or destructive behavior.
Install only if you specifically want help planning a Hello Landing or furnished-apartment dispute workflow. Because the trigger wording is broad and the demand evidence is weak, users should invoke it explicitly and avoid relying on it as legal advice.
The trigger guidance is so broad that ordinary requests containing generic words like 'help', 'hello', or 'dispute' could invoke this skill outside its intended scope. That increases the chance of inappropriate routing, low-quality or misleading assistance, and accidental activation in unrelated contexts.
The skill description and usage guidance are broad enough to match common terms like 'help', 'hello', 'landing', and 'dispute', which can cause the skill to activate for unrelated conversations. Unintended invocation can route users into irrelevant workflows, increasing the chance of misleading advice and reducing control over what tools or prompts are applied.
The keyword list contains ambiguous everyday terms such as 'hello' and 'landing' that are likely to appear in benign, unrelated requests. This creates a high risk of accidental triggering, especially in systems that auto-select skills based on keyword presence, potentially hijacking normal interactions into this specialized dispute workflow.
The skill description includes very broad trigger terms such as "general-help", "hello", and "landing", which are common in ordinary conversations and unrelated requests. This can cause unintended invocation of the skill, leading the agent to route users into dispute-handling workflows when they did not request them, increasing the chance of irrelevant guidance, privacy oversharing, or task hijacking.
The explicit trigger section repeats the same problem by listing unconstrained keywords and example invocations that match highly generic words. Because activation logic lacks boundaries, exclusions, or contextual requirements, normal user text containing words like "hello" or "general-help" may spuriously activate this specialized skill.
The trigger phrase 'Help me People repeatedly need a practical, repeatable way to handle Hello Landing Dispute - Furnished Apartments.' is overly broad because it begins with common conversational language likely to appear in unrelated user prompts. In an agent environment, broad activation increases the chance this skill is invoked accidentally, leading to inappropriate routing, irrelevant advice, and possible exposure of users to unsuitable dispute guidance outside the intended context.
The invocation section lacks clear boundaries on when the skill should and should not be used, and it provides no negative examples to prevent accidental matching. In this context, the evidence list is also largely unrelated to the stated requirement, making broad invocation guidance more dangerous because it can legitimize misapplication of the skill to arbitrary help requests.
The README claims validated demand for a housing-dispute assistance skill, but the cited evidence is largely unrelated programming and computer-support content, with only one apparently relevant Hello Landing dispute link. This is dangerous because it misrepresents the skill’s justification and can cause inappropriate activation, user trust erosion, and downstream reliance on a workflow that was not actually validated for the stated use case.
The trigger keywords and example phrases are overly generic, including terms like 'general-help', 'hello', and 'dispute', which are common in ordinary conversations. This can cause the skill to activate outside its intended scope, leading to irrelevant guidance, prompt-routing collisions, or accidental interception of unrelated user requests.
The example triggers use generic formulations like 'Help me' and 'I need a practical workflow' without boundaries that distinguish this skill from general assistance requests. In a trigger-driven environment, such examples encourage overly permissive matching logic and make accidental invocation more likely.
The default prompt contains a very broad activation phrase tied to generic terms like "help me" and a long natural-language requirement, which can cause the skill to be invoked in contexts beyond the intended housing-dispute use case. This increases the chance of accidental routing, prompt confusion, or unauthorized use of the skill when user intent is only loosely related.
Enabling implicit invocation without concrete activation constraints allows the platform to call this skill based on weak semantic matches rather than explicit user intent. Because the skill is framed around broad "general-help" and workflow support, this raises the risk of unintended invocation, data leakage into the skill context, or inappropriate guidance being injected into unrelated conversations.
The scoring rationale states strong corroboration, source diversity, and professional/community signal, but the actual evidence shown does not support those conclusions for the housing-dispute topic. Inflated or internally inconsistent scoring can improperly elevate the skill's priority or legitimacy, causing downstream systems or users to rely on an unvetted capability.
The evidence section claims to validate demand for a housing-dispute skill, but nearly all cited sources are unrelated technical posts about Rust, R, C++, URI schemes, and Windows/media tooling. This creates a misleading provenance trail and can cause the agent or reviewers to trust and route users to a skill based on fabricated or irrelevant support, undermining integrity of skill selection and decision-making.
The activation guidance mixes broad keywords like 'general-help', 'hello', and 'landing' with vague trigger sentences, making the skill eligible for many unrelated requests. This ambiguity is more dangerous in a general-help context because the skill can be spuriously selected in ordinary conversations, degrading routing quality and potentially displacing a more appropriate skill.
The file labels separate English and Simplified Chinese documents, but this specific README is a zh-CN localized variant and does not state that users may choose their preferred language. Under the policy, locale constraints should be opt-in or clearly justified.
No suspicious patterns detected.
