Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only product validation planning skill with broad triggers, but it does not request sensitive access, install code, persist itself, or perform hidden actions.
Install this only if you want a general product-validation planning helper. Be aware it may activate on broad product, SaaS, startup, or validation prompts, so users who need strict routing should narrow the trigger metadata before publishing widely.
The invocation guidance does not define clear inclusion and exclusion boundaries, so the skill may be invoked for a wide range of business, startup, or workflow requests that it was not intended to handle. In an agent system, ambiguous routing can expose users to irrelevant automation, unsafe task delegation, or unintended use of the skill as a catch-all for general planning requests.
The trigger sentence uses a very broad, natural-language phrase ('Help me...') that can cause the skill to activate for ordinary user requests that are only loosely related to product validation. Overbroad activation increases the chance of inappropriate routing, prompt hijacking surface, or accidental invocation in unrelated contexts, especially because the rest of the trigger text is truncated and not meaningfully constraining.
The documented trigger phrases are broad enough to match many ordinary business or product-help requests, which can cause the skill to activate outside the user's clear intent. In an agent environment, over-broad invocation increases the chance of unintended routing, context capture, or the model applying this workflow when a different tool or no tool should be used.
The skill description is scoped to a very broad class of common business requests and includes generic phrases like product idea, validation, prototype, and implementation support. This can cause the skill to activate for many loosely related prompts, increasing the chance of misrouting, over-privileged tool use, or unintended execution of this workflow when a more appropriate skill should handle the request.
The listed trigger keywords are highly generic and overlap with many ordinary user prompts, especially terms such as validation, prototype, saas, and startup. In a skill-routing system, such broad triggers can lead to unintended invocation and unreliable behavior, which is more dangerous here because the skill claims wide implementation support and may steer responses outside the user's actual intent.
This file is a Chinese-language regional variant, but it does not state applicability, fallback behavior, or how language choice is determined. In practice, this can lead to user confusion, incorrect routing, or inaccessible outputs if the system selects this skill for users who did not request Chinese, though the security impact is limited.
The skill description defines invocation conditions in vague terms such as broad topic areas and generic needs for workflows or analysis, without clear scope limits. This ambiguity can cause over-triggering and inappropriate use of the skill, which is dangerous operationally because users may receive domain-specific validation guidance when they actually need something else.
The trigger keywords are broad and overlap with common business/product conversations, making unintended activation likely. Misrouting ordinary requests into this skill can cause irrelevant planning outputs, reduce reliability, and in multi-skill environments may steer users away from safer or more appropriate handlers.
The default prompt uses broad, generic language around product help and workflows that can overlap with many ordinary user requests, increasing the chance this skill is invoked when the user did not explicitly intend it. Because implicit invocation is enabled, this ambiguity can cause over-activation of the skill, leading to prompt hijacking of unrelated conversations or unnecessary exposure of the skill’s instructions and behavior.
The trigger phrases are broad, generic requests such as asking for 'a practical workflow' around product ideas, validation, and prototypes. This can cause the skill to activate on ordinary conversation where the user did not explicitly intend to invoke this specialized planner, leading to misrouting, prompt overshadowing, or unintended execution of skill-specific instructions.
This file is a Chinese README variant and describes Chinese-language documentation artifacts, but it does not state that language selection is optional or user-driven. For a general product-validation skill, presenting a locale-specific variant without opt-in language guidance can conflict with language-choice policy expectations.
