Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overly broad activation wording, but no hidden execution, persistence, credential handling, or destructive behavior.
Before installing, consider narrowing activation to explicit AdMapix-related requests or disabling implicit invocation to avoid accidental use on generic data, app, or bug-fix questions. The inspected package does not show malware-like behavior or sensitive system access.
The trigger phrases are broad enough to match generic help requests, which can cause this skill to activate outside its intended AdMapix/raw-data workflow context. In an agent ecosystem, overbroad routing can lead to unintended invocation, confusing outputs, and possible bypass of safer or more appropriate skills for unrelated tasks.
The trigger phrases are broad, generic, and partially malformed, making accidental activation likely during ordinary software-help conversations. This can cause the wrong skill to intercept user requests, leading to context confusion, unintended data handling, or bypass of more appropriate, narrowly scoped skills.
The trigger sentence is phrased as a broad, natural-language request that could easily appear in ordinary conversation, making accidental or context-inappropriate skill invocation more likely. In an agent ecosystem, overly permissive activation boundaries can cause the wrong skill to run, leading to unintended data handling, workflow confusion, or execution of actions outside user intent.
This trigger pattern is generic enough to match many benign requests for a 'practical workflow,' without strong boundaries tying activation to this specific skill. That increases the chance of unintended routing or over-triggering, which is especially risky for agent skills that may influence downstream analysis, file handling, or operational steps.
This file is entirely presented as a Simplified Chinese user-facing README, with no indication in the content that the user may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is clearly justified.
The skill description is overly broad and includes common terms like 'software-and-data', 'raw', 'data', and 'layer', which can cause the skill to activate for many unrelated requests. This creates unsafe routing behavior where users may receive irrelevant or unintended guidance, and broad auto-invocation can interfere with more appropriate specialized skills.
The trigger list contains generic words such as 'raw', 'data', 'layer', 'apps', and 'bug fix' without contextual constraints. These terms are likely to match ordinary requests across many domains, increasing the chance of accidental invocation and misrouting of user interactions.
The trigger keyword list includes very generic terms such as "raw", "data", "layer", and "apps", which are likely to appear in many unrelated user requests. This can cause unintended skill invocation, increasing the chance that the agent routes users into the wrong workflow and produces irrelevant or unsafe assistance outside the intended scope.
The example trigger phrases begin with broad helper language like "Help me" and "I need a practical workflow," which does not clearly distinguish when this skill should activate. Ambiguous examples train routing systems and authors toward overbroad matching, making accidental invocation more likely in normal conversations.
The default prompt and skill phrasing are broad enough that ordinary user language about software, data, workflows, bugs, or implementation support could implicitly trigger this skill without clear user intent. Because implicit invocation is enabled, this increases the chance of unintended activation, context leakage, or the skill influencing conversations outside its narrowly expected scope.
The activation description does not clearly define when the skill should or should not run, and the listed keywords are common terms such as 'data', 'raw', 'apps', and 'bug fix'. In a multi-skill agent environment, this ambiguity increases the chance of over-triggering, causing misrouting and potentially exposing user context to an irrelevant skill.
The example trigger phrases are vague and effectively restate a broad demand statement rather than defining concrete activation boundaries. This can normalize imprecise invocation behavior and make downstream systems more likely to treat loosely related prompts as matches for the skill.
This file is a zh-CN skill document, but substantial portions of the description, audience definition, and trigger examples are fixed in English. That can implicitly force a language/locale experience without stating whether users may interact in Chinese, English, or choose their preferred language.
