Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple unit-test coverage workflow guide with no code execution, persistence, credential access, or hidden behavior.
This skill is reasonable to install for help with unit tests and coverage. Be aware it may activate on broad testing or quality-related requests, so users should confirm the agent is applying it only when they actually want unit-test or coverage assistance.
The trigger sentence is so generic that it can match ordinary user requests about testing or coverage that were not intended to invoke this specific skill. Over-broad activation can cause the wrong skill to run, leading to prompt/behavior hijacking at the orchestration layer, irrelevant guidance, or unintended access to project context when a more specific tool should have been selected.
The activation examples provide only positive, expansive examples and do not define boundaries for when the skill should not be used. Without scope constraints and negative examples, the system may over-trigger on loosely related requests, leading to misrouting and exposing more conversational contexts to the skill than necessary.
The trigger phrase is broad enough to match ordinary requests about getting help with unit tests or workflows, which can cause the skill to activate outside a narrowly intended context. Over-broad activation increases the chance of inappropriate routing, prompt hijacking surface, or user confusion when the assistant invokes this skill for generic testing discussions.
The trigger phrases are broad and map to common software-testing language, which increases the chance that the skill is invoked when a user did not explicitly intend to use it. In an agent ecosystem, unintended invocation can cause the wrong workflow to take over a conversation, potentially influencing outputs, consuming resources, or bypassing more appropriate specialized skills.
The skill description activates on very broad terms such as software-and-data, testing, and implementation support, which can cause the skill to be invoked for a wide range of ordinary engineering requests outside its intended scope. Over-broad routing increases the chance of unintended context capture, irrelevant guidance, or interference with more appropriate specialized skills, making system behavior less predictable.
The keyword list includes highly generic terms like testing, regression, and quality, which are likely to match many normal engineering conversations that are not specifically about unit-test coverage assistance. This can lead to excessive or incorrect skill activation, reducing routing precision and potentially exposing users to mismatched instructions or workflows.
The activation description is overly broad and can cause the skill to trigger for loosely related software requests, not just explicit unit-testing or coverage tasks. In an agent environment, ambiguous routing increases the chance of this skill being invoked in the wrong context, leading to irrelevant code changes, misleading guidance, or accidental override of a more appropriate specialized skill.
The keyword list contains generic terms like testing, regression, and quality without contextual constraints, which makes false activation likely. Overbroad keyword triggers are dangerous because they can route unrelated requests into this skill, producing off-target actions or advice and expanding the skill's effective authority beyond its intended scope.
The default prompt uses broad, generic triggers like 'software-and-data,' 'testing,' 'analysis,' and 'implementation support,' which can cause the skill to be invoked in contexts far beyond narrowly scoped unit-test coverage assistance. Because implicit invocation is enabled, this increases the chance of unintended routing, causing the agent to apply this skill to unrelated development tasks and potentially mishandle user intent or expose workflow influence where it was not expected.
The example trigger starts with a vague everyday phrase, which normalizes loose invocation patterns and may encourage activation from underspecified user requests. While lower severity than the broader description and keyword issues, it still contributes to accidental over-triggering and ambiguous routing behavior.
该技能文件整体以简体中文提供指令和触发描述，但没有任何说明表明这是可选语言版本，或允许根据用户偏好切换语言。按规则，若技能在自然语言层面强制特定语言而未提供选择，属于语言/区域策略风险。
