Security audit
Security checks for vulnerabilities and agentic risk
This is a low-risk planning skill for product validation, with broad activation wording but no code execution, credential access, persistence, or hidden data handling.
Before installing, be aware that the skill may be invoked for fairly broad product, SaaS, startup, validation, or prototype prompts. That may be convenient, but you may want to invoke it explicitly only when you need product-validation planning.
The trigger sentence is extremely broad and can match ordinary user requests for help with product ideas or workflows, causing the skill to activate outside a clearly bounded context. Over-broad activation increases the chance of unintended routing, prompt shadowing, or the skill influencing conversations where the user did not explicitly opt into this business-planning behavior.
The trigger description uses a broad natural-language formulation instead of concrete activation boundaries, which makes it easier for common requests to be interpreted as matching this skill. In agent systems, ambiguous trigger logic can lead to accidental invocation and inappropriate access to the skill's instructions or workflows.
The trigger phrases are broad enough to activate on generic product, startup, validation, or workflow requests that may not actually need this specific skill. Overbroad activation can cause the wrong skill to take control, leading to misrouting, irrelevant business guidance, and increased chance that a user request is handled with an unintended workflow.
The skill description is broad enough to match many ordinary product, startup, and planning requests, which increases the chance of unintended activation. Over-broad activation can cause the wrong skill to take over user interactions, reducing routing integrity and potentially suppressing more appropriate or safer specialized handling.
The keyword list uses vague, high-frequency terms like 'validation', 'prototype', 'saas', and 'product idea', which are likely to collide with many unrelated requests. This makes accidental invocation more likely and can degrade system behavior by broadening the skill's effective scope far beyond its intended domain.
The skill description defines its usage scope very broadly across business operations, product ideas, validation, prototypes, and SaaS support, without clear boundaries for inclusion or exclusion. This makes the skill eligible for a wide range of ambiguous prompts, increasing accidental activation and misapplication of the workflow in contexts it was not designed to handle.
The trigger section uses very broad, common keywords such as 'validation', 'prototype', 'saas', and 'startup', which can match many unrelated user requests and cause the skill to be invoked unintentionally. In an agent system, overbroad invocation increases the chance of inappropriate routing, irrelevant guidance, and interference with more suitable or safer skills.
The default prompt and skill description use very broad activation language tied to common business, product, and workflow requests, which can cause the skill to be invoked in situations beyond its intended scope. Because implicit invocation is enabled, this increases the chance of over-triggering, unexpected routing, and accidental exposure of users to skill behavior when they did not explicitly request it.
The activation examples are ambiguous and truncated, so they do not clearly define when the skill should and should not run. In an agentic system, unclear routing boundaries can cause misfires into common founder/product discussions, reducing reliability and potentially causing unintended tool or workflow execution based on the wrong context.
The trigger sentence is broad enough to match ordinary product or business requests, which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance of prompt routing errors, irrelevant skill invocation, and unintended exposure of the skill’s instructions or outputs in unrelated conversations.
The file lists separate English and Chinese instruction and guide files, but does not state how the user's language preference is determined or that language selection is optional. This can create a locale-policy concern if the skill chooses a language by default without explicit user opt-in.
This document is a Chinese-language README and explicitly points to a Chinese-language skill description, but it does not indicate that language is optional or user-selectable. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific.
The example trigger sentences are ambiguous and largely restate the broad requirement text without defining boundaries for when the skill should or should not activate. Poorly scoped examples reinforce over-triggering behavior and make it harder for the agent to distinguish this skill from general-purpose planning assistance.
