Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with no executable code or hidden data access, though its activation wording is too broad and may trigger unexpectedly.
Before installing, consider narrowing the trigger keywords or disabling implicit invocation so ordinary requests mentioning search or engines do not route through this skill unexpectedly. No evidence of malicious behavior or hidden system access was found.
The trigger list includes extremely generic terms such as "multi," "search," "engine," and "bug fix," which are likely to appear in many unrelated user requests. In an agent routing system, this can cause unintended activation and skill hijacking, where this skill is selected outside its intended scope and influences responses meant for other tools or workflows.
The activation description says the skill should be used for broad categories like work-productivity, multi, search, or engine, as well as for general workflow, checklist, analysis, or implementation support. This scope is so expansive that the skill may be invoked for many unrelated tasks, increasing the chance of incorrect delegation, prompt collisions, and unsafe overreach into contexts it was not designed to handle.
The trigger list includes extremely generic terms such as "multi", "search", and "engine", which are common in unrelated user requests. This can cause the skill to activate outside its intended scope, leading to misrouting, unintended behavior, or overshadowing of more appropriate skills in normal conversations.
The trigger sentence is so broad and unnatural that it can match ordinary user phrasing unrelated to intentional invocation, increasing the chance this skill activates when it should not. In an agent ecosystem, accidental invocation can redirect user requests into the wrong workflow, cause prompt-routing confusion, and expand the attack surface for prompt injection or unsafe tool use chained from the unintended skill.
The trigger phrases are extremely generic and include common words like 'multi', 'search', 'engine', and broad requests for a 'practical workflow', which can cause the skill to activate in many unintended contexts. In an agent ecosystem, over-broad activation can route unrelated user tasks into this skill, causing incorrect behavior, confusion, or unsafe application of workflow instructions outside their intended scope.
The trigger phrases are broad enough to match common, non-specific user requests, which can cause this skill to activate unexpectedly outside its intended scope. In an agent ecosystem, overbroad activation can route unrelated tasks through the wrong workflow, increasing the chance of unsafe tool use, confusing outputs, or policy bypass through accidental invocation chains.
The manifest description uses broad activation language like "Use when a user asks for work-productivity, multi-search-engine, multi, search, engine" and also covers generic requests for "practical workflow, artifact, checklist, analysis, or implementation support." This creates scope ambiguity that can overmatch routine requests and increases the chance of inappropriate invocation in shared agent environments.
The example trigger phrases are vague and resemble ordinary language, encouraging activation from broad, natural user prompts instead of precise requests. This reinforces overbroad routing behavior and makes accidental triggering more likely, especially when examples are used by matching heuristics or prompt-based dispatchers.
The default prompt is overly broad and composed of common natural-language phrases such as 'help me' and 'work productivity multi search,' which increases the chance the skill is invoked unintentionally in unrelated user requests. Because implicit invocation is enabled, this broad trigger surface can route conversations into the skill without clear user intent, causing inappropriate behavior, prompt hijacking exposure, or unexpected handling of user data.
This trigger remains ambiguous because it is still framed as a common-language request rather than a precise routing condition, so unrelated prompts could satisfy it. While slightly more specific than a bare everyday phrase, it still risks misrouting tasks and causing unintended behavior in environments where skills are auto-selected from user text.
The README states that the skill ships separate English and Chinese instruction and guide files, but it does not describe how the user's preferred language is selected. This can create a natural-language policy concern if the skill defaults users into a locale without explicit opt-in or selection behavior.
This Chinese README contains substantial English instructional content and example trigger phrases, but does not state whether users may choose their preferred language or locale. That can amount to an implicit language policy constraint without explicit opt-in.
