Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only product validation planning skill with broad auto-invocation wording but no code execution, persistence, credential access, or hidden data handling.
Before installing, be aware that this skill may activate for broad product, startup, validation, prototype, or SaaS wording. Its business advice should be treated as planning support rather than proof of market demand, especially because the included evidence list appears broad and should be independently checked before spending money or building a product.
The trigger phrases are generic and map to broad business/product terms such as 'validation', 'prototype', and 'startup', which increases the chance this skill is invoked for loosely related requests. Unintended invocation can route users into the wrong workflow, causing prompt hijacking of task selection, confusion, or accidental exposure of unrelated context to the skill.
The activation examples describe only positive matches and do not distinguish this skill from many adjacent business-assistance requests. Without clear non-activation criteria, orchestration systems may invoke the skill for general brainstorming, operations, or startup questions, increasing misrouting risk and making prompt behavior less predictable.
The trigger phrase is broad enough to match many ordinary product, business, or planning requests, which can cause the skill to activate outside its intended scope. In an agent system, overly broad activation can route users into this skill unexpectedly, override more appropriate skills, or expose downstream prompts and workflows in contexts they were not meant to handle.
The skill description includes broad activation terms such as 'business-and-operations', 'product idea', 'validation', 'prototype', and 'saas', which are common across many unrelated user requests. This increases the chance the skill is invoked outside its intended scope, causing prompt/skill hijacking of normal conversations and unintended exposure of the skill's behavior over a wide request surface.
The keyword list uses ambiguous phrases like 'product idea', 'validation', 'prototype', 'saas', and 'startup', which are highly likely to appear in ordinary conversation. In a skill-routing system, these high-collision triggers can cause overbroad matching, leading to misrouting, unnecessary skill activation, and a larger attack surface for adversarial prompt steering through unrelated requests.
文件整体为 zh-CN 本地化版本，但文档中未说明这是可选语言版本，也未提供用户语言选择或说明仅适用于特定地区/语言场景。根据规则，若技能对语言/locale 有约束而缺少用户 opt-in 或合理限定，可能构成自然语言策略违规。
The skill description uses broad business/product terms such as business-and-operations, product idea, validation, prototype, and saas without clear boundaries or exclusion conditions. This can cause accidental invocation on loosely related requests, routing users into the wrong skill and potentially generating irrelevant or misleading business guidance.
The keyword list is overly generic and contains common startup terms that appear in many unrelated conversations. Without scope constraints or negative examples, the skill may be invoked too often, increasing misrouting risk and reducing reliability of the overall agent behavior.
The skill enables implicit invocation with no narrow trigger scope, which can cause the agent to activate this skill in response to broadly related user requests without clear user intent. In a business/product-planning skill, this increases the chance of prompt-surface expansion, unintended data sharing into the skill context, and over-application of the skill to requests that only loosely match its purpose.
The invocation description and trigger boundaries are underspecified, covering generic terms like business-and-operations, product idea, validation, prototype, and practical workflow. Because these concepts appear in many benign conversations, the skill may over-trigger and steer sessions into this workflow without clear user intent, creating confusion and expanding the skill's effective authority.
The trigger sentence is extremely broad and resembles normal user phrasing, which can cause the skill to activate for many unrelated conversations about product ideas, validation, or workflows. Over-broad activation increases the chance of unintended tool routing, context hijacking, or the skill being applied where it was not explicitly requested, reducing predictability and safety.
No suspicious patterns detected.
