Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only product validation planning skill with broad activation wording but no code execution, persistence, credential handling, or hidden data access.
Install this if you want a lightweight planning assistant for product idea validation. Be aware that its trigger wording is broad, so it may be invoked for general product or startup planning questions; review outputs as business advice, not validated market evidence.
The trigger sentence is broad enough to match ordinary user phrasing about getting help, which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance of inappropriate routing, prompt collisions with other skills, and untrusted use of business-planning instructions in unrelated contexts.
The invocation description is ambiguous because it describes a very general need for a 'practical workflow' without clearly limiting the subject matter to product validation. This can lead to accidental invocation for unrelated tasks, reducing predictability and creating opportunities for skill misuse or interference with safer, more specific skills.
The trigger phrases are very broad and map to common business/product requests such as 'product idea', 'validation', and 'prototype'. This can cause the skill to activate in many unrelated conversations, creating routing hijack or unintended prompt-scope expansion where users are steered into this skill without clear intent.
The file descriptions explicitly label this README and companion documentation as Chinese and English variants, while the content mixes languages without stating that users may choose their preferred language. This can indicate a locale assumption in the skill documentation rather than an explicit opt-in choice.
The skill description is scoped so broadly that it can activate for generic requests about business, product ideas, prototypes, SaaS, workflows, and implementation help. Over-broad routing increases the chance this skill is invoked when a more appropriate or safer skill should handle the request, causing misrouting, unnecessary context capture, and policy bypass through unintended tool selection.
The trigger keywords and example phrases are ambiguous, high-frequency terms that match many ordinary conversations, making accidental activation likely. In an agent environment, such broad triggers can overshadow other skills, distort routing decisions, and expand the skill's effective authority beyond product-validation tasks.
技能描述将适用范围表述为 business-and-operations、product idea、validation、prototype、saas 等宽泛领域，缺少清晰的边界、排除条件和优先级规则。这种含糊启用条件会让编排系统难以区分何时应调用该技能，从而增加误用、越权式覆盖其他专用技能和输出不匹配结果的风险。
触发关键词包含 business-and-operations、product idea、validation、prototype、saas、startup 等高频宽泛词，且示例触发句也非常通用，容易与普通对话重叠。这会导致技能在不相关场景中被误触发，扩大其作用范围并影响路由准确性，进而造成错误建议、用户混淆或对其他更合适技能的覆盖。
The default prompt uses very broad, everyday phrasing such as helping with business operations, product ideas, validation, prototypes, and practical workflows. Because these topics are common in many benign conversations, the prompt can match far more requests than intended and make the skill activate in contexts where it is not the best or safest fit.
The skill enables implicit invocation while its purpose is broadly defined around common business, product, and workflow requests. This increases the chance the agent is auto-invoked for ordinary user queries outside a tightly scoped boundary, causing unintended routing, over-collection of context, or inappropriate influence over conversations.
The trigger sentence begins with a generic phrase ('Help me') and then appends a broad requirement description, making activation insufficiently scoped. This can cause the skill to match ordinary user requests that are only loosely related, leading to unintended invocation, context hijacking, or bypass of more appropriate specialized skills.
The trigger sentence 'I need a practical workflow for ...' is still too ambiguous because 'practical workflow' is a common phrase that can apply to many unrelated domains. In a routing system, this increases the chance of false-positive activation and may steer user requests into an overbroad business-planning skill that was not actually intended.
该文件为 SKILL.zh-CN.md，正文整体以简体中文面向中国区域表达，但文件中未见说明这是可选语言版本、也未向用户提供语言切换或选择。按规则，若技能强制特定语言或地区设置且没有用户 opt-in 或明确合理性说明，属于自然语言政策风险。
