Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only helper for unit test coverage work, with no hidden execution or persistence, though its automatic invocation triggers are broader than ideal.
Reasonable to install if you want a lightweight unit-testing workflow helper. Be aware it may activate on broad testing or quality-related prompts because implicit invocation is enabled; prefer explicit use when you want this skill's workflow.
The trigger sentence is highly generic ('Help me ...') and can match ordinary user requests that are not clearly intended to invoke this specific skill. In an agent environment, broad activation boundaries can cause unintended routing, over-invocation, or prompt capture by this skill when a more appropriate or safer workflow should handle the request.
This trigger uses a vague request template ('I need a practical workflow for ...') without clear activation constraints, making accidental or overly broad skill selection more likely. That ambiguity is risky because it can hijack unrelated conversations into this skill's workflow, reducing predictability and potentially interfering with least-privilege skill routing.
The trigger phrases are broad, natural-language prompts that can match ordinary user requests, increasing the chance of unintended skill invocation. In an agent environment, accidental activation can route tasks through the wrong workflow, produce irrelevant actions or outputs, and create opportunities for prompt-surface abuse if the skill activates more often than intended.
The skill description contains very broad invocation terms such as 'software-and-data' and generic requests for workflows, analysis, or implementation support. This can cause the skill to activate for loosely related prompts, increasing the chance that it is selected inappropriately and steers the agent into a less relevant or lower-safety workflow.
The example trigger begins with the everyday phrase 'Help me', which is overly generic and can match a large number of unrelated user requests. In routing systems that rely on keyword or semantic matching, such broad trigger phrasing raises the risk of accidental activation and misrouting.
The skill description uses very broad trigger terms such as software-and-data, unit tests, test coverage, testing, and regression, causing likely activation during ordinary development conversations that are only loosely related to this specific workflow. Over-broad activation can route users into an unintended skill context, creating prompt-scope confusion and increasing the chance of irrelevant, lower-quality, or policy-bypassing assistance.
The keyword list includes generic terms like testing, regression, and quality, which commonly appear in normal software discussions and are not specific enough to this skill’s purpose. This makes unintended activation more likely and can interfere with correct tool or skill selection, especially in environments where multiple skills compete based on keyword matching.
The skill enables implicit invocation while using a very broad description and default prompt that match common developer requests like testing, coverage, regression, workflow, and implementation help. This can cause the agent to auto-select the skill in situations beyond the user's explicit intent, increasing the chance of unintended prompt injection exposure, overreach in task routing, or unauthorized influence over responses.
The trigger phrase is broad enough to match ordinary user language rather than a clearly scoped invocation, which can cause the skill to activate in situations where the user did not explicitly intend it. In an agent system, that increases the chance of prompt routing mistakes, unnecessary context injection, and downstream unsafe or irrelevant actions based on the wrong skill.
A Chinese README contains key descriptive and trigger text in English, including the demand statement and invocation phrases, which can impose a language expectation on users without opt-in. The file does not state that English is required or offer a language/locale choice for invocation.
