Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only product validation planning skill with broad activation wording but no executable code, persistence, credential access, or hidden behavior.
Before installing, be aware that this skill may be selected for broad product, startup, or business-planning prompts. That may be noisy, but the inspected package does not show hidden execution, data access, persistence, or credential use.
The trigger sentence is broad enough to match many ordinary product or business requests, which can cause the skill to activate outside its intended scope. Overbroad activation increases the chance of misrouting user requests, unexpected tool behavior, and prompt-surface expansion where the skill influences conversations it was not specifically designed to handle.
The activation guidance does not define precise boundaries for when this skill should or should not run, leaving scope ambiguous. In a skill-routing system, that ambiguity can lead to accidental invocation on common business queries, expanding the skill's influence beyond user intent and increasing exposure to unsafe or irrelevant instruction handling.
The trigger phrase is broad enough to match many ordinary product or startup-related requests, which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance of prompt/context injection into unrelated conversations, misrouting user tasks, or overshadowing more appropriate skills.
The trigger phrases are broad enough to activate on generic requests about business, products, validation, or workflows, which can cause the agent to invoke this skill outside its intended scope. Over-broad activation increases the chance of irrelevant or conflicting guidance being injected into unrelated conversations, reducing reliability and potentially overriding more appropriate skills.
The manifest description uses broad invocation guidance such as 'Use when a user asks for business-and-operations, product idea, validation, prototype, saas' and 'needs a practical workflow, artifact, checklist, analysis, or implementation support'. Because these intents are extremely common and ambiguous, the skill may be selected for many unrelated conversations, expanding its reach beyond the intended requirement and increasing the risk of inappropriate routing or response shaping.
The trigger keywords are broad, generic terms like 'validation', 'prototype', 'saas', and 'startup' that commonly appear in ordinary conversations. This can cause the skill to activate outside its intended niche, leading to prompt hijacking of unrelated requests, degraded routing accuracy, or unintended influence over general product/business discussions.
The skill description defines activation conditions in very broad terms, covering multiple generic domains like business operations, product ideas, prototypes, and implementation support without clear limits. This ambiguity makes it difficult for the router to distinguish this skill from many ordinary requests, increasing accidental invocation and reducing predictability of agent behavior.
The trigger keywords are broad and map to common product and startup discussions, which increases the chance this skill activates in routine conversations where a more specific skill would be appropriate. Over-triggering can steer users into an unintended workflow, causing irrelevant guidance, misrouting, or suppression of better-matched skills.
The skill enables implicit invocation, but the trigger description is broad and unbounded: it applies to generic requests about business, product ideas, validation, prototypes, SaaS, workflows, artifacts, checklists, analysis, or implementation support. This increases the chance the agent will invoke the skill in situations the user did not clearly intend, potentially causing unauthorized data flow into the skill context or unexpected actions based on loosely related prompts.
The activation guidance lists broad keywords and loosely constrained trigger sentences without clear boundaries, making accidental invocation likely. In an agent system, ambiguous routing logic can degrade reliability and safety by causing this skill to intercept common requests that should go to more appropriate or narrower skills.
This file is a Chinese-language README and presents the skill instructions entirely in Chinese, but does not state whether language choice is optional or limited to a region-specific use case. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue unless the constraint is documented and justified.
