Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only helper for unit-test and coverage work, with broad trigger wording but no hidden execution, persistence, credential access, or destructive behavior.
Install this if you want a helper for unit-test coverage and regression-test workflows. Be aware that its activation language is broad, so it may be selected for general testing or quality requests unless your agent router requires explicit skill selection.
The trigger sentence is broad enough to match ordinary user requests such as asking for help with unit tests, which can cause the skill to activate unexpectedly. Over-broad activation increases prompt-routing risk, because the agent may invoke this skill in contexts where the user did not explicitly request it, potentially overriding more appropriate skills or causing unintended workflow execution.
Although it adds context, the trigger remains generic and resembles normal conversational language, so it may still be matched during routine discussion rather than deliberate skill selection. In an agent ecosystem, this can create accidental invocation, misrouting, and prompt-scope confusion, especially when multiple skills target similar software-engineering tasks.
The trigger phrases are generic and map broad user requests like testing, regression, or practical workflow directly to this skill, which increases the chance of unintended or overly eager activation. In an agent ecosystem, ambiguous activation can route unrelated requests into this skill, causing incorrect assistance, context leakage across tasks, or user confusion about why the skill was invoked.
The skill description includes broad trigger terms such as 'software-and-data', 'testing', and 'analysis or implementation support', which can cause the skill to activate for many general software requests outside the narrow scope of improving unit tests and coverage. Over-broad activation increases the chance of misrouting user requests, causing the agent to apply inappropriate workflows or expose irrelevant capabilities in contexts where they were not intended.
The example trigger phrases use generic language like 'Help me' and 'I need a practical workflow' combined with a long requirement sentence, which provides weak domain constraint and can train routing systems toward matching common everyday requests. In an agentic environment, such examples can broaden invocation behavior and lead to accidental selection of this skill for unrelated tasks.
The skill description defines usage in very broad terms across multiple domains and task types, without clear exclusion criteria. This increases the chance of accidental activation or over-application, which can override more appropriate skills or produce misaligned outputs in adjacent requests.
The trigger keywords are broad and generic, including common terms like 'unit tests', 'testing', and 'quality'. This can cause the skill to activate in routine software conversations where the user did not intend to invoke this specialized workflow, leading to scope confusion, irrelevant guidance, or unintended instruction precedence.
The default prompt is framed as a broad natural-language trigger for common software tasks like testing, coverage, regression, and implementation help, which creates a wide activation surface. In combination with agent routing, this can cause the skill to be invoked in contexts where the user did not clearly request this specific capability, increasing the chance of unintended prompt injection exposure, context mixing, or overbroad tool participation.
Enabling implicit invocation without a tightly scoped trigger policy allows the skill to auto-activate based on loosely related user language. Because this skill is designed for broad engineering assistance, implicit routing can expose user context or let the skill influence workflows even when testing help was not explicitly requested, increasing the risk of accidental invocation and cross-task interference.
The trigger sentence is broad enough to match ordinary user phrasing, which can cause the skill to activate outside its intended scope. In an agent system, overbroad routing can misapply specialized instructions or workflows to unrelated requests, creating confusion, incorrect outputs, or unsafe automation decisions.
The file labels SKILL.md as the English version and this README as the Chinese version, but the content mixes Chinese headings with substantial English body text and does not tell the user they can choose their preferred language. This creates a locale inconsistency and lacks an explicit user opt-in or language-selection instruction.
The file includes non-English source titles alongside English skill content, but it does not state whether outputs, prompts, or evidence handling may switch language based on source material. This can create an implicit language/locale behavior without giving the user a choice or documenting the constraint.
No suspicious patterns detected.
