Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation/workflow helper with overly broad activation wording but no code execution, credential handling, persistence, or hidden data access.
Install only if you want a broad productivity workflow helper. Be aware it may activate for generic Google, Workspace, CLI, or bug-fix requests, so users or maintainers should narrow the triggers if precise routing matters.
The skill description claims applicability to very broad terms like 'google', 'workspace', 'cli', 'analysis', and 'implementation support', which are common across many unrelated tasks. This can cause the skill to be invoked outside its intended scope, leading to incorrect routing, inappropriate authority being granted to the skill, or accidental exposure of users to unsuitable workflow guidance.
The trigger keywords include highly generic words such as 'google', 'workspace', 'cli', and 'bug fix' without any scoping conditions. In a skill-routing system, these broad triggers can cause frequent unintended activation, overshadow more appropriate skills, and increase the chance that sensitive or unrelated requests are handled by an ill-fitting workflow.
The invocation description says the skill should be used for broad categories like work-productivity, gog, google, workspace, and practical workflow support, without clearly constraining the scope. This ambiguity can lead to frequent accidental invocation and inappropriate delegation, especially because several listed terms are common in benign, unrelated user requests.
The trigger keywords are very broad and include common terms like "google", "workspace", "cli", and "bug fix", which can cause the skill to activate during ordinary conversations unrelated to this specific workflow. Over-broad activation increases the chance of unintended routing, causing users to receive irrelevant guidance or exposing downstream tools and actions in contexts where they were not intended.
The trigger examples are broad natural-language phrases that overlap with ordinary user requests about workflows, setup, or practical help. This can cause the skill to activate when the user did not explicitly intend to invoke it, leading to unintended routing, over-application of the skill, or interference with more appropriate skills.
The trigger sentences and keywords are broad enough to match common terms like "google," "workspace," "cli," and generic requests for a "practical workflow," which can cause unintended skill activation. In an agent ecosystem, ambiguous activation expands the chance that this skill handles requests outside its intended scope, potentially leading to unsafe automation, context confusion, or invocation over more appropriate, narrower skills.
The activation guidance does not define clear boundaries for when the skill should and should not be used. In a multi-skill agent environment, this ambiguity increases the chance of over-triggering on ordinary work-productivity requests, causing scope confusion, unintended tool usage patterns, and priority inversion against more relevant skills.
The trigger phrases are broad and map to common productivity terms like 'google', 'workspace', 'cli', and generic requests for a 'practical workflow'. This can cause unintended activation in unrelated conversations, leading the agent to invoke this skill when the user did not intend it, which may redirect behavior, produce irrelevant actions, or interfere with safer/more appropriate skills.
The skill enables implicit invocation without any bounded trigger conditions, so the agent may automatically select or activate it for loosely related requests. This expands the skill’s execution surface and can cause the assistant to apply workflow guidance in contexts the user did not clearly intend, increasing the risk of prompt-routing abuse, unintended actions, or overbroad data exposure through unnecessary skill use.
