Security audit
Security checks for vulnerabilities and agentic risk
This skill provides ordinary planning guidance, although its misleading name and broad activation keywords may cause irrelevant responses.
Check that you want the ReprHighlighter planning workflow described inside; the title suggests a different purpose. Explicit invocation can reduce irrelevant activation. Treat its demand scores as publisher claims, not verified measures of usefulness.
The trigger list includes everyday terms such as add, support, and units without requiring a ReprHighlighter context. Line 4 reinforces these as alternative activation conditions, so unrelated requests can trigger the skill despite its specialized requirement.
The trigger list includes everyday terms such as add, support, and units, and the description at L04 likewise presents generic terms as activation conditions. Neither section requires a ReprHighlighter measurement-unit context or provides exclusions, so unrelated requests could invoke this skill.
The description is truncated and the default prompt concerns ReprHighlighter measurement units, while the display name identifies a business migration planner. With implicit invocation enabled and broad activation terms in the metadata, this ambiguity can cause unintended skill selection and irrelevant guidance. The supplied file contains no executable actions, sensitive-data handling, or instruction overrides, so the demonstrated security impact is limited to routing reliability.
Generic keywords such as add and support, reinforced by the metadata's broad activation description, could cause this skill to be selected for unrelated requests if routing relies on those terms. This is a low-impact scope-control weakness that could misdirect assistance; the README contains no executable payload, exfiltration instructions, or evidence of deliberate hijacking.
No suspicious patterns detected.
