Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only unit-test helper skill whose code inspection, test-writing, and test-running guidance matches its stated purpose.
Installers should expect this skill to guide an agent through reading project code, adding or editing test files, and running test commands when unit testing or coverage work is requested; consider narrowing implicit triggers if accidental activation on generic quality requests would be disruptive.
The trigger phrase uses broad, natural language that could match many ordinary requests rather than a clearly scoped invocation condition. This can cause unintended activation of the skill, leading the agent to apply testing/coverage workflows in contexts where the user did not explicitly request this capability, which increases the risk of misrouting, overreach, or prompt-surface expansion.
The description says to use the skill when a user needs 'practical workflow, code, checklist, documentation, or review support for this job,' which is broad and not tightly scoped to a distinct invocation boundary. This could overlap with many ordinary software-help requests and make it unclear when this skill should activate versus more general coding or documentation skills.
The keywords include broad terms like 'quality' and potentially generic phrases like 'coverage' or 'test plan' without context constraints. These can appear in many unrelated conversations, increasing the risk of accidental activation.
The trigger list is broad enough to activate on many generic software-testing requests, including cases that may only loosely relate to adding meaningful unit-test coverage. Over-broad activation can cause the wrong skill to be invoked, increasing the chance of irrelevant guidance, unintended workflow steering, or prompt-scope interference in multi-skill environments.
The skill enables implicit invocation but does not define a narrowly scoped trigger condition beyond a broad testing-related description. This can cause the agent to invoke the skill in contexts the user did not clearly intend, increasing the chance of unnecessary code inspection, unintended file modifications, or prompt-surface expansion through an automatically selected skill.
The trigger examples lack clear activation boundaries and exclusions, so the router or agent may invoke the skill on ambiguous requests that only partially resemble the intended use case. In a testing helper skill, this is less dangerous than a destructive or privileged skill, but it still creates reliability and security concerns by widening when the skill can influence behavior.
This markdown file is written entirely in Chinese and labels itself as the Chinese user guide, but it does not state within the file that language selection is optional or that the locale-specific version is intended for users who chose Chinese. Under the policy rule for natural-language constraints, forcing a specific language without user opt-in can be a violation unless the locale constraint is clearly documented and justified.
The file is a zh-CN skill document, but it embeds English audience descriptions and trigger keywords such as "software maintainers," "QA engineers," and "quality" without stating whether the skill requires or prefers a specific language. This can create an implicit language policy or usability issue without user opt-in.
