Security audit
Security checks for vulnerabilities and agentic risk
The skill contains no runnable code or persistence, but its name and routing metadata describe a different purpose than its actual instructions and allow broad implicit invocation.
Review this skill carefully before installing. It appears to be a documentation-only skill, but its catalog identity does not match its actual Claude Code prompt-cache topic, and its broad implicit invocation could cause it to appear in unrelated coding requests. It should be renamed, scoped to precise prompt-cache terms, and have implicit invocation disabled or tightly constrained before normal use.
The README claims to be a 'USA Business Migration Planner' while the actual requirement, evidence, and triggers are about Claude Code prompt cache behavior. This mismatch can cause the wrong skill to be selected or trusted under false pretenses, creating a prompt-routing and user-deception risk even without executable code.
The skill is named 'usa-business-migration-planner' but the actual content is about Claude Code prompt cache behavior, creating a strong identity/purpose mismatch. This can cause incorrect routing or stealthy invocation under an unrelated name, making it easier for a misleading or low-quality skill to be activated in contexts where users and reviewers would not expect it.
The trigger description is excessively broad, covering generic terms like software-and-data, programmer, claude, and code, plus vague requests for workflows or analysis. Broad activation criteria can cause the skill to intercept many ordinary conversations unrelated to its actual purpose, increasing the chance of unintended prompt injection, misrouting, or user confusion.
The skill presents itself as a USA business migration planner, but its actual content is about Claude Code prompt-cache behavior. This identity mismatch can cause the wrong skill to be invoked, mislead reviewers and users about the skill’s purpose, and undermine trust and safety controls that depend on accurate labeling and scope.
The inline documentation reinforces a contradictory identity by branding the skill as a USA business migration planner while documenting a Claude Code cache advisory workflow. In skill-routing systems, contradictory documentation increases the chance of accidental or inappropriate activation and can mask the true operational behavior during audit or approval.
The trigger keywords include broad common terms such as software-and-data, programmer, claude, code, prompt, and cache, which are likely to appear in many normal technical conversations. That makes unintended invocation likely, potentially causing irrelevant guidance to be injected into unrelated tasks and broadening the blast radius of any mistaken or unsafe behavior in the skill.
The manifest presents the skill as a USA business migration planner, but its description and default prompt are about an unrelated Claude Code prompt-cache topic. This identity mismatch can mislead users and routing systems, causing unintended invocation and trust confusion, and it may also be used to disguise the true behavior of the skill.
The trigger phrases are broad and templated enough that the skill may activate for loosely related requests, especially because they repeat generic language like 'practical workflow' and embed the invocation token directly. In an agent ecosystem, ambiguous activation increases the chance of unintended tool selection, context confusion, and delivery of irrelevant or unsafe guidance.
The README presents the skill as a USA business migration planner while the actual described purpose is Claude Code prompt-cache guidance. This identity mismatch can mislead users and routing systems, causing the wrong skill to be invoked and undermining trust in the skill catalog. In an agent ecosystem, deceptive or inaccurate packaging increases the chance of inappropriate execution in unrelated contexts.
The usage section explicitly tells users to invoke a migration planner for Claude Code prompt-cache help, contradicting the apparent skill intent. This can cause accidental activation from unrelated prompts and creates an opportunity for capability smuggling, where a vaguely named skill is used to handle topics outside its declared scope. In security-sensitive agent environments, such scope confusion weakens operator oversight and policy enforcement.
The trigger phrases and keywords are broad enough to overlap with common software and coding requests, increasing the likelihood that the skill is selected in situations the user did not intend. Overbroad matching is dangerous because it can hijack normal workflows, surface irrelevant instructions, and make it easier for a mislabeled or low-quality skill to influence responses at scale. The misleading business-migration branding makes this broader matching more concerning, not less.
The listed trigger keywords are too generic to safely identify only this skill's intended use, especially 'code', 'claude', 'prompt', and 'cache'. In a multi-skill environment, such common keywords can over-trigger the skill and crowd out more relevant tools, leading to unreliable behavior and making abuse through deceptive naming or routing easier.
The example trigger phrases use everyday formulations like 'Help me' and 'I need a practical workflow for ...', which do not establish clear activation boundaries. Examples like these encourage loose matching behavior and make accidental triggering more likely, especially in systems that learn from documented invocation patterns.
The default prompt text is broad, awkwardly scoped, and mixes multiple topic triggers, which increases the chance that the skill will be selected for unrelated user requests. In combination with the misleading identity metadata, this can produce prompt-routing confusion and expose users to outputs from the wrong skill.
Enabling implicit invocation without clear trigger constraints allows the platform to auto-select this skill based on vague similarity, which is risky when the manifest already contains inconsistent and overly broad metadata. That makes accidental or inappropriate activation more likely and can undermine user intent and trust.
The trigger phrases are overly broad and include natural-language constructions like 'Help me' and 'I need a practical workflow', which can match many unrelated user requests. In an agent routing context, this can cause accidental invocation of the skill outside its intended scope, leading to irrelevant guidance, confusion, or unintended processing of user inputs under the wrong workflow.
The README specifies English and Chinese instruction and guide files, but does not state how the user's preferred language is selected or whether the skill respects user choice. That can create a locale-policy concern if the skill defaults users into a language without explicit opt-in.
Several user-facing sections in this zh-CN README, including the workflow description and trigger phrases, are written in English only. This can amount to forcing a specific language in a locale-specific document without opt-in or justification.
The default_prompt contains Chinese text ('Claude Code 的 Prompt Cache 到底怎么工作？ 5 个让缓存失效的坑.') even though the skill is otherwise presented in English, and there is no indication that the user can choose language or that the locale is intentionally constrained. This may violate language/locale policy by implicitly forcing or mixing languages without user opt-in.
The requirement statement embeds Chinese text inside an otherwise English skill document, and the trigger phrases repeat that mixed-language wording. The file does not state whether responses should follow the user's preferred language or that the skill is intentionally limited to a Chinese-language use case.
