Security audit
Security checks for vulnerabilities and agentic risk
This is a simple documentation-only testing helper; its main issue is overly broad activation wording, not unsafe behavior.
Before installing, be aware that this helper may be invoked more often than expected because its keywords include broad terms like testing, regression, and quality. It is otherwise a normal unit-test workflow skill with no executable installer or hidden runtime behavior found.
The trigger sentence is extremely broad and can match ordinary user requests, causing the skill to activate in situations beyond its intended scope. Over-broad activation increases the chance of prompt/skill routing hijacks, unnecessary context injection, and accidental interference with other, more appropriate skills.
The invocation pattern uses a generic request form ('I need a practical workflow for ...') that lacks discriminating constraints, making accidental or adversarial triggering easier. In an agent system, this can misroute user requests and allow this skill to preempt safer or more relevant workflows, especially because the surrounding domain keywords are common in software conversations.
The trigger phrases are broad natural-language requests that can match ordinary user prompts, causing the skill to activate unintentionally. In an agent environment, overbroad activation can redirect requests into the wrong workflow, increase prompt-surface exposure, and create opportunities for policy bypass or confusing tool behavior even though this file itself does not contain direct code execution.
The trigger keywords are broad enough to match many ordinary software-help requests, which can cause the skill to be invoked outside its narrow intended scope. While this is not code-execution dangerous by itself, overbroad activation can route users into an unintended workflow, increase prompt-surface exposure, and create opportunities for incorrect or unsafe task handling.
The example trigger phrases use very generic language patterns like 'Help me' and 'I need a practical workflow', which can unintentionally match routine requests that are not specifically about this skill. This raises the likelihood of accidental invocation and misrouting, especially in environments where trigger examples influence matching behavior.
The skill description is scoped to a very broad set of software-and-data requests and says to use the skill whenever users ask for unit tests, testing, regression, or implementation support. That increases the chance of unintended auto-invocation in ordinary coding conversations, causing the agent to apply a canned workflow or produce code modifications in contexts where the user did not explicitly request this skill.
The trigger keywords include very generic terms like testing, regression, and quality, which are common in many unrelated engineering discussions. This makes accidental activation likely, potentially steering conversations, exposing internal skill behavior unnecessarily, or causing the agent to overreach into tasks outside the intended unit-test coverage use case.
The default prompt contains a very broad natural-language trigger phrase covering common terms like software, testing, regression, workflow, analysis, and implementation support. Because implicit invocation is enabled, this increases the chance the skill is auto-selected for ordinary user requests that merely mention these common topics, causing unintended routing and expanded exposure of the skill beyond narrowly relevant contexts.
The trigger sentence begins with a broad everyday phrase ('Help me ...'), which can cause the skill to activate unintentionally during normal conversation rather than only when the user explicitly requests this specific capability. In an agent system, over-broad invocation increases the chance of context hijacking, misrouting, or accidental execution of testing-oriented workflows on unrelated requests.
该文件名为 README.zh-CN.md，且部分标题为中文，但 L5、L32 以及 L40-L42 等关键用户可见内容仍为英文，没有说明这是仅英文适用或提供用户语言选择。对于中文本地化文档，这种未说明的语言切换可能违反语言/locale 选择应由用户决定的要求。
No suspicious patterns detected.
