Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only helper skill with broad activation wording, but I found no hidden execution, persistence, credential access, or destructive behavior.
Install only if you want a general AdMapix-style software/data workflow helper. Be aware it may activate on broad software or data requests because of its generic keywords and implicit invocation, so check that the selected skill matches your task before relying on its output.
The trigger phrases are broad, generic, and partially malformed, making them likely to match ordinary user requests that were not intended to invoke this skill. This can cause unintended skill activation, reducing user control and potentially routing unrelated requests into workflows that process software/data tasks unexpectedly.
The skill description and activation guidance are broad enough to match many ordinary software or data-help requests that are not specific to this skill’s intended AdMapix-style workflow. In an agent routing system, this can cause inappropriate auto-selection, leading the agent to apply the wrong workflow, expose unrelated context to the skill, or bypass more specialized safeguards.
The keyword list contains highly ambiguous terms such as 'raw', 'data', 'layer', 'apps', and 'bug fix', which are common across many unrelated requests. Such generic triggers materially increase the chance of accidental invocation or prompt-routing collisions, making the skill more dangerous in shared agent environments where trigger-based dispatch influences behavior.
The trigger examples use very generic phrasing such as 'Help me' and 'I need a practical workflow' tied to a broad requirement summary, which can cause the skill to activate for unrelated user requests. In an agent ecosystem, overly broad activation expands the skill’s execution surface and may route users into this skill when they did not intend to invoke AdMapix-specific behavior.
The trigger phrases are generic and partially templated, so they can match a wide range of unrelated user requests and cause unintended skill activation. In an agent ecosystem, over-broad invocation increases the chance that this skill handles tasks outside its intended scope, which can lead to incorrect workflow selection, leakage of context to the wrong skill, or unsafe automation decisions.
This is a Chinese README, but the activation examples are presented only in English and imply those are the required trigger utterances. That creates a language/locale constraint without user opt-in or justification.
The example trigger sentences use everyday phrasing like 'help me' and 'I need a practical workflow' without meaningful scope limits, which teaches the router or authoring pattern to associate the skill with overly general requests. While less severe than the keyword issue, it still broadens activation and can misroute users into an irrelevant or less safe workflow.
The skill description says to use the skill when users mention broad categories or need practical support, but it does not define clear boundaries for applicability. Ambiguous enablement rules increase the chance of mis-triggering and inappropriate use, which can degrade safety and reliability if the wrong skill handles a request.
The trigger keywords are overly broad, including generic terms like 'raw', 'data', 'layer', 'apps', and 'bug fix'. This can cause the skill to activate for unrelated requests, leading to accidental routing, irrelevant guidance, or unintended application of this workflow in contexts it was not designed for.
The skill enables implicit invocation without any visible trigger scoping, guardrails, or contextual constraints. This can cause the agent to invoke the skill in broader situations than intended, increasing the chance of unexpected data handling, unsafe workflow execution, or user confusion when the skill is applied automatically.
The activation guidance does not clearly define what distinguishes in-scope AdMapix-style software/data tasks from ordinary software help, making dispatch ambiguous. This ambiguity increases the chance of unintended activation, misrouting, and policy/safety bypass through an over-permissive trigger surface.
文件名和正文均表明这是一个中文（zh-CN）版本的技能，但文档中没有说明语言选择机制，也未告知仅在用户明确选择中文时使用。若该技能在通用场景下被调用，可能构成未获用户同意的语言/locale 限制。
