Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documentation-only helper for unit-test coverage work, with no executable payload or hidden privileged behavior found.
Installers should be aware that the skill may activate for broad testing or quality requests. It is otherwise scoped to unit-test coverage assistance and should be safe to use when you want help planning, writing, or verifying tests in an existing codebase.
The trigger phrases are generic and map to broad concepts like testing, regression, and practical workflow support, which increases the likelihood the skill will be invoked for loosely related requests. Unintended invocation can cause routing mistakes, irrelevant guidance, or overshadowing of more appropriate skills, especially in automated or multi-skill selection systems.
The README lists activation phrases such as 'Help me ...' and 'I need a practical workflow ...', which overlap with common everyday language and do not clearly distinguish when this skill should activate versus when it should not. The trigger section also lacks negative examples or tighter scope constraints to prevent unintended invocation collisions.
The description uses very broad invocation terms like 'software-and-data,' 'testing,' 'analysis,' and 'implementation support,' which can cause the skill to activate for many routine engineering requests outside its intended niche of improving unit tests and coverage. Over-broad routing increases the chance of mis-selection, causing the agent to apply the wrong workflow, produce irrelevant artifacts, or override a more appropriate skill in security- or reliability-sensitive contexts.
The trigger keywords are generic and lack boundary conditions, especially terms like 'testing,' 'regression,' and 'quality,' which commonly appear in unrelated requests. In an agentic environment, this can cause excessive or incorrect activation, leading to prompt-routing confusion and reducing the reliability of skill selection.
Using an example trigger that starts with the everyday phrase 'Help me' makes the trigger pattern dangerously permissive because many benign user requests begin that way. This increases accidental invocation likelihood and can bias a router toward this skill even when the request is only loosely related or unrelated to unit-test coverage.
The description says to use the skill whenever a user mentions broad categories like software-and-data, testing, or needs general implementation support, which creates ambiguous activation criteria. This can lead to accidental invocation on unrelated requests, reducing least-privilege behavior and increasing the chance of the agent applying the wrong workflow or leaking irrelevant internal guidance.
The trigger keywords are broad and lack clear boundaries, so the skill may activate for generic testing or software requests that do not specifically need unit-test coverage help. In an agent system, overbroad activation can cause incorrect routing, unexpected invocation, and unnecessary exposure of the skill’s instructions or outputs in unrelated contexts.
The default prompt is phrased as a broad natural-language trigger around common development activities like unit tests, test coverage, and testing, which can cause the skill to be invoked in situations beyond a user's explicit intent. Because implicit invocation is enabled, this increases the chance of over-activation and unintended routing of normal software-engineering requests into this skill, which can interfere with least-privilege behavior and create prompt-scope confusion.
The trigger sentence uses very generic phrasing ('Help me', 'I need a practical workflow') combined with broad software/testing terms, which can cause the skill to activate for many unrelated requests. In an agent-routing context, this increases the chance of unintended invocation, misrouting user tasks, and overshadowing more appropriate or safer skills.
