Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overly broad activation wording, but no evidence of hidden execution, credential access, persistence, or destructive behavior.
Install only if you want a general workflow helper for multi-search-engine-style productivity tasks. Because its implicit triggers are broad, consider narrowing or explicitly invoking it by name to avoid accidental activation during unrelated search or productivity requests.
The trigger phrases are broad and include generic terms like "multi", "search", and "engine", which can match ordinary user requests unrelated to this skill. This can cause accidental invocation or routing collisions, making the agent apply the wrong workflow, potentially exposing users to unintended behavior or reducing trust in skill selection.
The manifest description says to use the skill when a user asks for broad concepts like "work-productivity," "multi," "search," or needs almost any "workflow, artifact, checklist, analysis, or implementation support." That invocation boundary is so broad that the skill could be selected for many unrelated tasks, increasing misrouting risk and enabling unintended instruction influence.
The trigger keyword list includes extremely generic terms such as "multi," "search," "engine," and "supports," which are common in ordinary user prompts. This makes unintended activation likely, causing the skill to intercept unrelated requests and potentially override more appropriate routing or inject irrelevant workflow behavior into benign tasks.
触发关键词包含 multi、search、engine、global、supports 等高频通用词，容易在大量普通对话中误触发该技能。误触发会让代理偏离用户真实意图，注入与当前任务无关的工作流指令，降低结果可靠性，并在某些编排环境中放大权限或数据流风险。
The trigger sentence is extremely broad and can match ordinary user language about "help me" and generic workflow needs, causing the skill to activate outside its intended scope. In an agent-routing system, this can lead to misrouting, unintended invocation, and prompt-surface expansion where this skill handles unrelated requests and influences downstream behavior.
The trigger sentence is extremely broad and resembles ordinary user language, which can cause the skill to activate unintentionally in unrelated conversations. In an agent ecosystem, overbroad activation can hijack routing, interfere with more appropriate skills, and increase the chance that downstream instructions are applied in the wrong context.
The invocation description uses generic wording for a common productivity request rather than defining precise conditions for when this skill should run. This creates ambiguous routing and can lead to accidental invocation, which is especially risky for a broadly described helper skill intended to transform requests into workflows and deliverables.
The README is in Chinese, but the invocation examples are primarily English without offering a language choice or localized alternatives. This can cause users to invoke the skill incorrectly or misunderstand how activation works, increasing the chance of misrouting or operational errors, though it is mainly a reliability and usability weakness rather than a direct security flaw.
The example trigger sentences are vague and repetitive, and they do not establish clear boundaries for when the skill should or should not activate. Poor trigger examples reinforce overbroad matching behavior and make accidental invocation more likely during routine prompts involving general workflow or search language.
技能描述中的适用条件覆盖面很宽，例如“当用户提出 work-productivity, multi-search-engine, multi, search, engine，或需要围绕该需求获得实用流程、产物、检查清单、分析或实现支持时使用”，缺少清晰边界。这样的描述会使路由器或维护者倾向于在模糊场景下启用技能，增加非预期调用和上下文污染的概率。
示例触发句几乎只是重复需求文案，没有展示清晰的调用边界，也没有提供负例来帮助区分普通对话与真正的技能激活请求。这会增加实现方对触发逻辑的误判，使技能在相似措辞下被过度调用。
The default prompt includes a very broad natural-language trigger phrase covering generic terms like work-productivity, multi, search, engine, workflow, artifact, checklist, analysis, and implementation support. Because implicit invocation is enabled, this can cause the skill to activate in many ordinary conversations unrelated to the user's intent, increasing the chance of unintended prompt injection exposure, data overreach, or unsafe workflow execution.
Although longer, this trigger still contains generic wording like "I need a practical workflow" and embeds requirement text that is not likely to be spoken verbatim by users, making matching ambiguous and error-prone. Such ambiguity increases false positives and can cause the skill to intercept common productivity requests that should be routed elsewhere.
