Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only product validation planning skill with broad auto-invocation wording but no evidence of hidden execution, data access, persistence, or destructive behavior.
This skill appears safe to install for product idea validation and planning. Be aware that its broad keywords and implicit invocation may make it appear in general startup, SaaS, prototype, or validation conversations where a narrower skill might be preferable.
The skill description is broad enough to match many ordinary business, planning, and analysis requests, which increases the chance of unintended invocation. Over-broad activation can route user requests into a specialized workflow without explicit intent, causing prompt-scope confusion, unreliable behavior, and potential interference with safer or more appropriate skills.
The example trigger sentences use vague natural language such as 'Help me' and 'I need a practical workflow,' which closely resembles ordinary user requests. In a skill-routing system, examples like these can encourage matching on commonplace phrasing, increasing accidental invocation and making the skill more dangerous because its domain already overlaps heavily with general advisory tasks.
The trigger phrases are generic and map to broad business/product terms like 'validation', 'prototype', and 'saas', which increases the chance the skill will be invoked for loosely related requests rather than explicit user intent. Unintended invocation can route user prompts into the wrong workflow, causing confusing outputs, disclosure of unnecessary context to the skill, or interference with more appropriate skills.
The trigger phrases are broad, generic requests such as asking for a practical workflow or help with product ideas, which can easily overlap with ordinary user queries. This can cause the skill to activate unintentionally and steer unrelated conversations into its workflow, reducing user control and increasing the chance of inappropriate context capture or task hijacking.
The keyword triggers are generic terms like product idea, validation, prototype, and startup, all of which commonly appear in normal conversation. This makes accidental activation likely and can let the skill capture prompts outside its intended scope, degrading routing integrity and making downstream behavior less predictable.
The skill description defines applicability in overly expansive terms, covering broad categories like business operations, product idea, validation, prototype, and SaaS without clear boundaries. In a skill-routing system, such ambiguity can make this skill capture requests outside its intended scope, increasing the chance of misexecution, prompt interference, or bypass of safer and more specialized skills.
The trigger keywords are very broad and overlap with common business/product conversations such as 'prototype', 'validation', 'startup', and 'product idea'. This can cause the skill to activate in many unrelated contexts, leading to unintended workflow injection, user confusion, or suppression of a more appropriate skill, even though the content is not overtly malicious.
The skill enables implicit invocation while providing only a broad, generic description of when it should be used. This increases the chance the agent will auto-select the skill in loosely related business or product conversations, causing unintended data exposure to the skill context or unintended actions based on overbroad routing.
The trigger sentences are extremely broad and can activate on ordinary product-help phrasing without clear boundaries, increasing the chance the skill is invoked when the user did not intend it. Over-broad activation is dangerous because it can route unrelated requests into this workflow, causing inappropriate handling, misleading outputs, or prompt-space interference with more suitable skills.
The file is explicitly presented as a Chinese-language user guide variant (README.zh-CN.md), which indicates a locale-specific version. There is no visible statement in this file offering language choice or user opt-in, so the content may be interpreted as enforcing a locale-specific experience without documented choice.
The document includes Chinese-language source titles and incorporates them into the skill context, but it does not explain whether the skill may respond in Chinese or how language selection is handled. Because locale and language behavior is not documented as user-selectable or region-specific, this may create an implicit language-policy issue.
