Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple product-planning prompt package with no executable code, network access, persistence, or credential handling, though its activation wording is overly broad.
Before installing, consider narrowing the trigger keywords or disabling implicit invocation so the skill only activates for explicit product-validation or Ask HN product-help requests. There is no evidence that it runs code, accesses private data, or changes your system.
The description uses ambiguous activation guidance such as "Use when a user asks for creative-and-content, ask-hn, ask, product, very" without defining clear boundaries for invocation. In a skill-routing system, vague activation criteria increase the chance of misfires and unintended delegation, which can degrade reliability and expose downstream workflows to irrelevant or sensitive user context.
The trigger keyword list is overly broad and includes common terms like "ask," "product," "very," "high," "quality," and "ready," which are likely to appear in unrelated conversations. This can cause accidental skill activation, routing user requests into the wrong workflow and potentially overriding more appropriate skills or system behavior.
The example trigger sentences are too generic and do not clarify what distinguishing context should be present before activation. Because the examples resemble normal user phrasing, they reinforce broad matching behavior and make unintended activation more likely.
The skill description and default prompt use highly generic phrasing like 'Help for a Product,' which makes invocation criteria ambiguous and increases the chance the agent will trigger this skill for unrelated requests. Overly broad matching can route user input into an unintended workflow, causing incorrect task handling, prompt-scope confusion, or abuse by attackers who deliberately phrase requests to hijack tool selection.
The trigger scope is overly broad because it includes generic keywords like "ask," "product," "very," and "ready," which can match many unrelated user prompts. This can cause the skill to activate outside its intended context, leading to inappropriate routing, reduced reliability, and possible interception of requests that should be handled by more suitable or safer skills.
No suspicious patterns detected.
