Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only GitHub workflow helper with broad activation wording but no hidden execution, data access, persistence, or destructive behavior.
Installers should be aware that this skill may activate on fairly generic GitHub or CLI requests. It appears safe as a workflow helper, but its triggers would be better narrowed if you want predictable routing.
The trigger phrases are broad enough to match common developer requests such as asking for help, needing a workflow, or invoking a GitHub-related task. In an agent-routing context, this can cause unintended activation of the skill, leading the system to apply this workflow when the user did not explicitly request it and increasing the chance of prompt/skill hijacking through ambiguous routing.
The skill description is extremely broad and maps to common developer requests like GitHub, CLI, issues, workflows, and implementation help. In agent routing systems, this can cause the skill to activate for many unrelated prompts, creating prompt-scope hijacking where this skill preempts more appropriate or safer specialized skills and influences outputs outside its intended boundary.
The trigger keywords include highly generic, high-collision terms such as 'github', 'cli', 'issue', 'run', and 'api' without contextual qualifiers. This increases the likelihood of accidental invocation across a wide range of unrelated tasks, allowing the skill to overreach its intended domain and potentially interfere with routing, policy selection, or task-specific safeguards.
The trigger sentence is excessively broad and resembles normal user phrasing, which can cause the skill to activate when a user did not explicitly intend to invoke it. In an agent environment, unintended activation can route requests into the wrong workflow, causing irrelevant actions, disclosure of repository-related context, or unsafe automation paths that the user did not mean to authorize.
The trigger sentences are highly generic and closely mirror broad user intents like needing help, a workflow, or GitHub-style support. This can cause unintended invocation of the skill in contexts where the user did not specifically request it, increasing the chance that an agent applies the wrong workflow or exposes repository-related actions inappropriately. The skill context makes this somewhat more dangerous because it is positioned for practical GitHub, CLI, issues, and PR workflows, which may influence operational or code-related actions if invoked accidentally.
The file is presented as a Chinese README, but core descriptive and usage content, including trigger phrases, is written in English. This imposes a language choice on users without explicit opt-in or explanation, which is a natural-language locale policy concern.
The example trigger sentences use generic everyday phrasing and mostly restate the broad requirement instead of defining precise activation boundaries. This normalizes ambiguous triggering behavior and makes it easier for routine user requests to match the skill, compounding the over-broad routing risk created by the description and keyword set.
The trigger keyword list includes very broad terms such as 'run' and 'api', along with common development words like 'github', 'cli', and 'issue'. This can cause the skill to be invoked in many unrelated conversations, increasing the chance it overrides a more appropriate skill or injects workflow guidance where it was not intended.
The example trigger phrases begin with very generic requests like 'Help me' and 'I need a practical workflow for', which are common across many unrelated tasks. If activation logic relies on these examples or similar loose matching, the skill may be selected too often, leading to accidental invocation and reduced reliability of the overall agent system.
The default prompt and display metadata are broadly phrased around common developer tasks like helping with bugs, reliability, setup, and Github-style workflows. Because implicit invocation is part of the skill policy, this broad language can cause the skill to activate in ordinary conversations where the user did not clearly request it, increasing the chance of unintended tool routing or prompt injection exposure through over-broad matching.
Implicit invocation is enabled even though the skill definition does not provide clear constraints that limit when it should be invoked. In a broad developer-assistance context, this can let the skill engage on loosely related requests, which may override user expectations, expose sensitive repository context to an unnecessary skill, or increase the attack surface for adversarial prompt content embedded in user requests.
The trigger guidance is scope-loose and uses broad invocation phrasing without boundaries, making accidental or overbroad skill selection more likely. Because this skill is positioned for GitHub-style workflows, ambiguous triggering could steer unrelated software or general-help requests into a workflow that assumes issue/PR/CLI context and may produce mismatched or risky operational guidance.
No suspicious patterns detected.
