Security audit
Security checks for vulnerabilities and agentic risk
This is a low-risk unit-test workflow skill with somewhat broad activation wording but no hidden execution, credential access, persistence, or data exfiltration behavior.
Installers should know this skill may activate on broad testing or quality requests, so it may be noisier than a tightly scoped unit-test helper. Its behavior is otherwise ordinary for coding assistance: review generated tests and commands before applying them to your repository.
The trigger phrases are broad enough to match ordinary user requests such as 'help me' or 'I need a practical workflow,' which can cause this skill to activate outside its intended scope. In an agent system, overly broad routing can override more appropriate skills, leading to incorrect behavior, prompt-scope confusion, or unintended execution paths.
The trigger phrases are very broad and include generic testing and software terms, which can cause the skill to activate in contexts where the user did not explicitly request this workflow. Over-broad activation increases the chance of unintended tool/skill invocation, misrouting user requests, and allowing this skill to influence conversations outside its intended scope.
The description and usage guidance are broad enough to match many ordinary software requests, which can cause this skill to activate outside its narrow intended scope. Over-broad activation increases the chance of prompt hijacking at the routing layer, incorrect tool selection, or irrelevant instructions being injected into unrelated coding tasks.
The trigger keywords are generic terms like 'software-and-data', 'testing', and 'quality', which overlap heavily with normal development conversations. In a multi-skill agent, this can make the skill fire too often, creating misrouting and unnecessary exposure of the skill's instructions in contexts where they do not belong.
The skill description and activation criteria are broad enough to match many ordinary testing-related requests, which can cause the skill to be invoked outside its narrowly intended purpose. Over-broad routing is dangerous because it can override more appropriate skills, increase unintended data exposure to the wrong workflow, and produce irrelevant or lower-quality guidance.
The keyword list contains vague, high-collision triggers such as broad testing and quality terms that are likely to match many unrelated conversations. In a skill-routing system, this can lead to accidental invocation, misrouting, and context capture by a skill that was not the best fit for the user’s request.
The default prompt is framed as a generic help trigger for broad testing-related requests, while the policy also allows implicit invocation. That combination can cause the skill to activate in many ordinary software conversations, increasing the chance of unintended routing, over-collection of context, or the skill influencing tasks outside a narrowly scoped user request.
The trigger sentence is so generic that ordinary user requests about unit tests or practical workflows may invoke this skill unintentionally. Overly broad activation increases the chance of prompt-routing mistakes, causing the agent to apply this skill outside its intended scope and potentially override more appropriate, safer, or more specialized handling.
The file advertises separate English and Chinese instruction and guide files, but the README does not explain how language is selected or whether the user can choose their preferred language. This can create a locale-handling ambiguity that may result in the skill forcing a language without explicit user opt-in.
