Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only product-validation planning skill; its activation language is broad, but it does not run code, request credentials, persist data, or use privileged tools.
Installers should be aware that this skill may activate for broad startup, SaaS, prototype, or validation wording. It is otherwise low risk because it is documentation-only and does not request special permissions, credentials, background execution, or access to private data.
The skill description activates on very broad categories like business-and-operations, product idea, validation, prototype, and implementation support, which are common across many unrelated user requests. This can cause the skill to be invoked outside its intended scope, increasing the chance of inappropriate guidance, prompt-space interference, or overshadowing more specific skills.
The trigger keywords are generic startup and product terms that appear in ordinary conversations, making accidental or excessive routing likely. In a multi-skill agent, this broad matching can hijack requests that should go to other specialized skills, reducing control over tool selection and potentially exposing users to irrelevant or lower-quality outputs.
The trigger sentence is broad enough to match ordinary user phrasing about needing help or a workflow, which can cause the skill to activate outside its intended niche. Over-broad invocation logic increases the chance of incorrect routing, prompt collisions with other skills, and unintended execution in unrelated conversations.
The invocation guidance does not clearly distinguish in-scope versus out-of-scope usage, which can lead to accidental activation on generic business or planning requests. In an agent environment, ambiguous routing can expose users to unintended instructions, interfere with other more appropriate skills, and make behavior less predictable.
The trigger sentence is broad enough to match ordinary help-seeking requests and could cause the skill to activate in contexts where the user did not specifically intend product-validation support. Over-broad activation increases the chance of prompt-routing mistakes, irrelevant instruction injection into unrelated tasks, and confusion about which skill should control the response.
This file is explicitly a Simplified Chinese README and presents the skill documentation entirely in Chinese without indicating that users may choose another language or locale. The policy requires avoiding language forcing unless there is opt-in or a clearly justified regional constraint, neither of which is stated in this file.
The trigger phrases are broad, generic, and closely match common product/business requests, which can cause the skill to activate in situations far beyond the author’s intended scope. This increases the chance of unintended routing, prompt overshadowing, and misuse of the skill in contexts where a more appropriate or safer skill should handle the request.
The activation description says to use the skill for broad categories like business operations, product ideas, validation, prototypes, and SaaS needs, which are expansive domains rather than a tightly scoped task. This ambiguity can cause the orchestrator or user to invoke the skill in contexts it was not designed for, increasing the risk of misrouting and unintended instruction precedence.
The trigger keywords are broad, generic terms like 'validation', 'prototype', 'saas', and 'startup' that can match many ordinary conversations and cause the skill to activate outside its intended niche. Over-broad activation increases the chance that unrelated requests are routed through this skill, which can lead to inappropriate guidance, prompt shadowing, or interference with more suitable skills.
The default prompt uses a broad, loosely constrained invocation phrase tied to generic business/product requests, which can cause the skill to activate in contexts beyond the author's likely intent. This increases the chance of accidental routing, prompt interference, or misuse when user requests only partially match the described domain.
The activation examples do not clearly define when this skill should or should not be used, and they largely restate the requirement text rather than providing discriminating examples. This ambiguity can cause the orchestrator or user to invoke the skill for broad business, operations, or planning requests that are not actually about product validation, reducing routing integrity.
The file is a Chinese-language skill description, but the trigger phrases and sample invocations are presented only in English. This can impose an English-centric activation pattern without stating that users may choose their preferred language or locale.
