Security audit
Security checks for vulnerabilities and agentic risk
This is a guidance-only raw-data workflow helper with somewhat broad triggers but no hidden execution, credential access, persistence, or destructive behavior.
Reasonable to install for AdMapix or app-market raw-data workflow guidance. Review the broad auto-invocation behavior if your environment routes skills implicitly, especially around generic analytics, revenue, or ETL prompts.
The trigger sentence begins with an extremely broad phrase ('Help me'), which can cause accidental or overbroad invocation if matching is heuristic or keyword-based. In an agent ecosystem, this increases the chance that unrelated user requests are routed into this skill, leading to inappropriate guidance, context leakage across tasks, or unsafe action selection based on the wrong workflow.
The trigger example "Clean this app-ranking CSV without losing the original source data" is phrased like a normal task request rather than a narrowly scoped invocation pattern. In a README for a skill, this can create ambiguity about when the skill should activate versus when a general assistant should simply answer the request.
The skill description and usage guidance are broad enough to match many ordinary data, analytics, or workflow requests, which can cause the agent to invoke this skill outside its intended AdMapix-style raw-data hardening niche. Over-broad auto-invocation increases the chance of misrouting user requests, unnecessary exposure of internal workflow instructions, and unsafe downstream actions if the skill is applied to data contexts with different privacy or security requirements.
The keyword list includes generic terms like "raw data," "app analytics," "rankings," "revenue," and "ETL," which are common across many domains and can trigger unintended activation. In an agent environment, loose keyword triggers can lead to over-selection of this skill, causing context confusion, inappropriate handling of sensitive datasets, or bypass of more specialized skills with tighter controls.
The skill enables implicit invocation but provides no visible trigger constraints, exclusions, or narrowing conditions in this file. That can cause the agent to auto-select this skill for broad analytics- or data-related prompts, expanding the attack surface and increasing the chance that adversarial or ambiguous user input routes into a powerful workflow unexpectedly.
The invocation section lacks a clear trigger boundary and includes malformed examples containing requirement-analysis text instead of user-facing intents. This ambiguity makes the skill easier to invoke unintentionally or in the wrong context, which is dangerous in agent environments because misrouted skills can produce irrelevant actions, mishandle sensitive context, or interfere with safer routing and policy decisions.
The file presents these lines as trigger sentences for when to use the skill, but the text is not a user request about AdMapix raw-data workflows. Instead, it repeats internal requirement-validation language about demand on Clawhub, which conflicts with the documented intent of matching real user needs such as workflow, code, checklist, or review support.
