Security audit
Security checks for vulnerabilities and agentic risk
This is a simple documentation-only helper skill with somewhat broad activation wording but no hidden code, persistence, credential handling, or destructive behavior.
Before installing, be aware that this skill may activate on broad terms like data, apps, raw, or bug fix. It appears safe as a documentation helper, but users may prefer narrower trigger wording or explicit invocation to avoid irrelevant routing.
The trigger sentences are generic and expansive, combining broad categories like software-and-data, raw, data, and bug fix with vague activation phrases. This can cause the skill to activate outside its intended scope, leading to unintended handling of unrelated requests and increasing the chance that unsafe or incorrect instructions are applied in the wrong context.
The trigger phrase is broad enough to match ordinary help requests, which can cause the skill to activate outside its intended scope. That creates prompt-routing risk: unrelated user input may invoke this skill, exposing users to incorrect workflows, unintended data handling, or interference with more appropriate skills.
The trigger phrases are broad, natural-language prompts such as 'Help me...' and 'I need a practical workflow...', which can overlap with ordinary user requests and cause unintended skill activation. In an agent environment, this increases the risk of prompt-routing mistakes, where the skill is invoked outside its intended scope and may influence unrelated tasks or expose users to incorrect workflows.
The trigger list includes highly generic terms such as 'raw', 'data', 'layer', 'apps', and 'bug fix', which are common across many unrelated requests. This can cause unintended activation of the skill in contexts outside its intended scope, leading to misrouting, confused task handling, and increased chance that a user receives irrelevant or lower-safety guidance from the wrong workflow.
The example trigger phrases are vague and effectively match ordinary help requests, which reinforces overbroad routing behavior. Because examples often shape downstream classifier or author behavior, ambiguous examples increase the likelihood that the skill activates for unrelated prompts and produces mismatched outputs.
The skill description defines usage in very broad terms and does not clearly state when the skill should not be used. This ambiguous scope increases the chance of inappropriate invocation, especially because the described outputs include workflows, analysis, implementation support, and code changes across a wide problem space.
The trigger keywords are overly broad and include generic terms such as "raw", "data", "layer", and "apps", which can cause the skill to activate for unrelated requests. In an agent system, this can misroute user tasks, override more appropriate skills, and produce irrelevant or lower-safety outputs in contexts the skill was not designed for.
The default prompt uses a very broad natural-language trigger phrase ('Use $software-data-admapix-raw-developer-helper to help me ...') tied to generic software/help wording, which can overlap with ordinary user requests. Because implicit invocation is enabled, normal conversation about software, data, workflows, bugs, setup, safety, reliability, or implementation support could unintentionally activate this skill and route user input into it without clear user intent.
This trigger is ambiguous because it does not clearly define when the skill should be invoked versus when a general software-help skill should handle the request. Ambiguous activation expands the skill's effective authority and increases the chance of misrouting, especially in multi-skill systems where overlapping phrases can cause the wrong capability to run.
This Chinese README presents the invocation examples only in English, which can amount to forcing a specific language for activation without explicit user opt-in. The file does not mention that users may invoke the skill in Chinese or choose their preferred language.
文件名和正文以中文呈现，且未见任何说明允许用户选择其他语言或根据用户偏好切换语言。若组织要求避免未经用户同意强制特定语言/区域设置，这种单一语言定向描述可能构成自然语言策略问题。
