Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only unit-test workflow skill with somewhat broad triggers, but no hidden execution, persistence, credential use, or destructive behavior was found.
This skill appears safe to install for unit-test and coverage assistance. Be aware that its broad trigger words may cause it to appear for general testing or quality requests, so users who want tighter routing should invoke it explicitly only for unit-test coverage work.
The skill description and activation guidance are broad enough to match many general software requests, which can cause unintended invocation. Over-broad routing is dangerous because it may inject irrelevant workflow instructions into unrelated tasks, reducing reliability and potentially causing the agent to disclose or act on unnecessary repository context.
The trigger sentences are generic enough that ordinary user requests about unit tests or practical workflows could invoke the skill unintentionally. Over-broad activation can cause incorrect routing, unnecessary context capture, or the skill being applied outside its intended scope, which is a security and safety concern in agent systems that auto-select tools based on loose matching.
The trigger phrases are generic enough to match ordinary user requests about testing and workflows, which can cause the skill to activate outside its intended scope. In an agent system, over-broad invocation can lead to prompt/skill hijacking of unrelated tasks, reduced user control, and unintended exposure of repository or code context to a skill that was not explicitly requested.
The keyword triggers are highly generic terms like 'testing' and 'quality' without qualifiers or exclusions, making accidental activation likely. In a multi-skill environment, this can override more appropriate skills or cause this skill to steer conversations that are not actually about unit-test coverage work.
The example trigger phrases use vague everyday wording like 'Help me' and 'I need a practical workflow' combined with repeated requirement text, which provides poor activation precision. This makes the router more likely to match on generic assistance requests rather than true test-coverage needs, leading to misrouting and degraded agent behavior.
The skill description is broad enough to match many ordinary software-help requests, which can cause the agent to invoke this skill when the user did not specifically ask for test-coverage assistance. Over-broad triggering is dangerous because it can route conversations into the wrong workflow, produce irrelevant code changes or advice, and interfere with safer or more appropriate skills.
The trigger keywords include generic terms like "testing," "regression," and "quality," which are common across many unrelated requests and can lead to frequent false activations. In an agent ecosystem, this broad matching increases the chance of incorrect tool selection and can degrade reliability or override more context-appropriate skills.
The default prompt and description trigger on very broad phrases like software, data, testing, regression, workflow, artifact, checklist, analysis, or implementation support, which overlap heavily with ordinary developer requests. This can cause the skill to be invoked in many unrelated coding contexts, increasing the chance that users are routed into this skill unexpectedly and that its instructions influence tasks beyond its intended scope.
The trigger sentence is so broad and unnatural that it could activate in unrelated conversations, causing the wrong skill to be invoked. In an agent system, overbroad routing can expose users to irrelevant instructions, unexpected file/code handling, or bypass of more appropriate safeguards tied to narrower skills.
This is a Chinese-language README, but key user-facing sections such as the demand statement, workflow description, and trigger phrases are written in English. That can impose a language preference on users without stating that language choice is optional or justified.
文件本身为 SKILL.zh-CN.md 且全文以中文提供说明，但文档中没有说明这是可选语言版本，也没有向用户提供语言选择。根据规则，若技能在自然语言层面强制特定语言而无用户选择，可能构成语言/区域策略问题。
The evidence list includes Chinese-language titles and locale-specific sources, but the document does not explain that the skill is region-specific or offer any language/locale choice. This can conflict with language/locale policy expectations when a skill appears generally applicable but incorporates a specific locale without documentation.
