Security audit
Security checks for vulnerabilities and agentic risk
This is a simple unit-test workflow skill with overly broad activation wording but no hidden execution, data access, persistence, or destructive behavior.
Install only if you want an agent to help with unit-test coverage planning or implementation. Be aware it may activate on broad testing or quality requests, so review the agent's proposed code changes and test commands before accepting them.
The trigger phrase is so broad and awkwardly templated that it can match ordinary user requests unrelated to this specific skill, causing unintended skill activation. In an agent setting, overly broad routing increases the chance of prompt/context injection from irrelevant conversations and can lead to incorrect or over-privileged behavior being applied where it was not intended.
The trigger sentences are broad and generic enough that the skill could be invoked in situations where the user did not explicitly request this specific helper. In an agent system, overly permissive activation boundaries can cause unintended routing, increasing the chance of irrelevant guidance, prompt-scope confusion, or misuse of the skill in contexts it was not designed to handle.
The trigger phrases are broad enough to match common testing-related requests, which can cause the skill to activate when the user did not explicitly intend to invoke it. In an agent system, ambiguous activation expands the skill's reach and can lead to inappropriate application, prompt-context pollution, or accidental execution of workflow guidance outside its intended scope.
The skill description uses very broad activation language like 'software-and-data' and common testing-related terms, which can cause the skill to activate on many ordinary development requests outside its intended scope. Over-broad routing is dangerous because it can override more appropriate skills, create prompt-selection confusion, and expand the blast radius of any bad instructions or weak guidance contained in the skill.
The keyword list includes generic terms such as 'testing' and 'quality' without qualifiers, making the trigger surface much broader than the stated purpose of the skill. This increases the chance of accidental invocation on unrelated requests and can lead to inappropriate agent behavior, misrouting, or unintended influence over user interactions.
The example trigger starts with the generic phrase 'Help me', which is common in ordinary user requests and makes invocation ambiguous when combined with broad domain language. Ambiguous trigger examples can cause the orchestration layer or downstream prompt matchers to select this skill too often, reducing routing precision and potentially exposing users to irrelevant or lower-quality guidance.
The top-level description says to use the skill whenever users ask for broad categories like "software-and-data", "unit tests", "test coverage", "testing", or "regression", without clearly defining exclusions. Such ambiguous activation logic increases the chance of accidental invocation and misclassification of user intent.
The trigger section includes broad keywords such as "testing" and "quality", which are common across many unrelated software requests. This can cause the skill to be invoked outside its intended scope, leading to inappropriate routing, confused responses, or overshadowing more specific skills.
The default prompt trigger phrase is broad and maps to very common requests about software, testing, and implementation help. Because implicit invocation is enabled, normal user language could unintentionally activate this skill, causing prompt injection surface expansion or unexpected routing into a skill the user did not explicitly choose.
The README lists separate English and Chinese instruction files, but does not state how language selection occurs or whether the user can choose their preferred locale. Because language/locale policy violations apply to all file types, this is a mild concern if the skill defaults to one language without explicit user opt-in.
该技能文件整体以 zh-CN 中文简体形式编写，且内容未说明是否允许根据用户偏好切换语言或 locale。按策略，若技能自然语言说明隐含固定语言输出而无用户选择或正当区域限定，可能构成语言/locale 约束问题。
No suspicious patterns detected.
