Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only product validation planning skill with broad activation wording but no hidden code, credential access, persistence, or destructive behavior.
Installers should be aware that the skill may activate for broad product, SaaS, startup, or validation requests. Review or narrow the trigger wording if precise routing matters, but there is no evidence here of code execution, credential handling, persistence, or data exfiltration.
The invocation guidance does not define firm activation boundaries, so an orchestrator or user may invoke the skill for loosely related business, startup, or planning requests. In agent systems, ambiguous routing guidance is dangerous because it can lead to unintended tool/skill selection, prompt interference, and inconsistent behavior across normal user interactions.
The trigger sentence is broad enough to match many ordinary product or business-help requests, which can cause the skill to activate outside its intended scope. Overbroad activation increases the chance of prompt-routing mistakes, where the skill injects its workflow into unrelated conversations and overrides more appropriate handling.
The trigger phrases are broad, generic, and closely match common user requests such as asking for help with workflows, validation, prototypes, or startup planning. This can cause the skill to activate in many ordinary conversations outside a clearly scoped product-validation context, increasing the chance of unintended routing, over-collection of business context, or inappropriate reliance on this skill when a more suitable capability should respond.
The skill description and use conditions are broad enough to match many ordinary business, product, and implementation requests, which can cause the agent to invoke this skill outside its narrowly intended scope. Over-broad routing increases the chance of misapplication, response hijacking of unrelated tasks, or priority inversion where this skill crowds out more appropriate and safer skills.
The listed keywords and example triggers are ambiguous, generic, and common across many benign conversations, making accidental or excessive activation likely. Because terms like 'validation,' 'prototype,' 'saas,' and 'startup' are underspecified, the skill may capture requests that do not actually require this workflow, reducing routing precision and potentially exposing users to irrelevant or lower-quality guidance.
The activation description is vague and covers a wide range of user needs like business operations, product ideas, validation, prototypes, and implementation support without clear exclusion criteria. In a routing system, this ambiguity increases the chance of unnecessary invocation, causing misclassification and potentially less accurate or less safe task handling.
The trigger keywords are broad and overlap with common business/product conversations, which can cause the skill to activate in situations where the user did not intend specialized product-validation behavior. Over-triggering can steer conversations unnecessarily, suppress better-matched skills, or introduce irrelevant assumptions into business guidance.
The default prompt is framed as a generic catch-all invocation for broad business, product, validation, prototype, and implementation support, without meaningful constraints on when the skill should activate. Combined with allow_implicit_invocation: true, this can cause the agent to invoke the skill in loosely related contexts, increasing the chance of prompt-scope overreach, unintended handling of sensitive business queries, or tool routing abuse.
The trigger sentence begins with a very broad everyday help-request pattern, which can cause the skill to activate in situations far beyond its intended scope. Over-broad invocation increases the chance of prompt routing mistakes, causing the agent to apply business-validation workflows when the user did not explicitly request this skill.
The trigger uses a generic 'I need a practical workflow' pattern without requiring clear product-validation context, making accidental invocation likely. In agent systems, ambiguous triggers can hijack unrelated user requests and route them into this skill, reducing reliability and potentially suppressing more appropriate tools.
该技能文件整体以 zh-CN 形式提供内容，且未见任何自然语言说明表明用户可选择其他语言或按用户偏好输出。根据规则，若技能在语言/地区上施加约束而无用户选择或明确理由，可能构成语言策略问题。
