Security audit
Security checks for vulnerabilities and agentic risk
This skill is an instruction-only helper for planning Nextcloud support, with no executable code or hidden data access, though its automatic trigger terms are broader than ideal.
Before installing, be aware that the skill may activate on generic support or feature-request language. It is otherwise narrowly about Nextcloud support planning and does not ship code or request sensitive access.
The skill description uses broad activation terms such as 'software-and-data', 'enhancement', 'add', and 'support', which are common across many unrelated requests. This can cause unintended invocation, routing users into this skill when they did not ask for Nextcloud-specific help, creating context confusion and increasing the chance of irrelevant or unsafe downstream guidance.
The keyword list includes high-collision generic words like 'add', 'support', 'feature', 'request', 'related', and 'problem' without any scoping condition. In a skill-routing system, these broad triggers can match a large volume of unrelated prompts, causing accidental activation and misapplication of the skill's instructions.
The default prompt includes a broad invocation phrase tied to common terms like 'help,' 'support,' 'analysis,' and 'workflow,' which can cause the skill to activate in many unrelated conversations. This increases the chance of unintended routing of user requests and accidental exposure of the skill's behavior in contexts where the user did not explicitly ask for it.
Enabling implicit invocation without clear constraints allows the skill to be triggered automatically based on vague matches rather than explicit user intent. In this skill, the broad enhancement-oriented description compounds that risk, making mis-invocation more likely and potentially causing unintended actions, recommendations, or data handling in unrelated sessions.
The trigger phrase is broad enough to match ordinary user language about adding support or needing help, which can cause the skill to activate outside its intended scope. In an agent system, overly broad activation can misroute requests, cause irrelevant guidance to be injected, and increase the chance that a less-appropriate skill handles sensitive or unrelated tasks.
No suspicious patterns detected.
