Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overly broad activation wording but no evidence of hidden, destructive, credential-seeking, or persistent behavior.
Installers should be aware that this skill may be invoked too easily for ordinary search or workflow requests because of its broad keywords and implicit invocation setting. It is otherwise low risk as packaged; consider tightening triggers if precise routing matters.
The trigger phrase is broad enough to match common user requests, which can cause the skill to activate outside its intended context. In an agent ecosystem, this increases the chance of unintended workflow injection, irrelevant execution, or the skill overshadowing more appropriate tools, reducing user control and potentially propagating unsafe guidance.
The trigger phrases are broad enough to match ordinary requests containing generic terms like 'multi', 'search', 'engine', or 'workflow', which can cause unintended activation of this skill. In an agent ecosystem, overbroad routing can misapply the skill to unrelated tasks, leading to incorrect behavior, unexpected tool use, or reduced trust in automation.
The trigger list includes extremely generic terms such as 'multi', 'search', 'engine', 'integration', and 'global', which are common in unrelated requests. In an agent skill system, this can cause accidental invocation and prompt/context hijacking of normal user tasks, leading to incorrect routing, unintended behavior, or unsafe delegation to the wrong skill.
The trigger list includes extremely generic terms such as "multi", "search", and "engine", which are likely to match many unrelated user requests. This can cause accidental activation, routing users into an unintended workflow, and increasing the chance that irrelevant instructions or outputs are applied in the wrong context.
The trigger sentence is broad enough to match ordinary user requests that are not specifically about this skill, which can cause unintended invocation or routing. In an agent ecosystem, overbroad activation can misapply workflows, override more appropriate skills, and increase the chance of unsafe or irrelevant actions being suggested in the wrong context.
The activation guidance does not clearly define boundaries for use, so the skill may be selected for loosely related 'search' or 'workflow' tasks without validating fit. In a multi-search productivity context, ambiguous routing can expose users to incorrect automation paths, tool misuse, or accidental chaining with external-search capabilities when a safer or narrower skill should have been chosen.
The file is a Chinese-language README while also containing English content, but it does not state that language is optional or user-selectable. For a general productivity skill, presenting the instructions in a fixed locale without opt-in can violate language/locale policy expectations.
The description says to use the skill when a user asks for broad concepts like 'work-productivity', 'multi', 'search', or 'engine', which creates an ambiguous activation boundary. This makes the skill more likely to activate outside its intended context, increasing the chance of misrouting user requests and introducing irrelevant or unsafe workflow instructions into unrelated tasks.
The example trigger sentences model vague, everyday phrasing and effectively encourage activation from broad natural-language requests. In practice, examples strongly influence tool-selection behavior, so these loose examples can amplify over-triggering and make the skill match unrelated conversations.
The activation description says the skill should be used whenever a user mentions broad categories like work productivity or search-engine-related terms, which is ambiguous and over-inclusive. In an agent environment, vague routing rules can misfire often, causing incorrect tool selection, unintended behavior, and possible leakage of task context into an unrelated skill flow.
The skill enables implicit invocation while providing only a broad, generic description and default prompt. That can cause the agent to auto-select this skill in contexts that only loosely match 'work productivity' or 'multi-search', increasing the chance of unintended activation, over-broad data exposure to the skill context, and actions being taken without clear user intent.
This trigger uses generic request phrasing ('I need a practical workflow for...') that overlaps heavily with normal conversation, making accidental matches likely. That broad matching can cause the skill to activate outside intended scenarios, reducing reliability and potentially surfacing inappropriate guidance for unrelated tasks.
