Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-style workflow helper with no executable payload, but its activation terms are broader than they need to be.
Install only if you want a general workflow helper around Nano Banana Pro-style skill patterns. Be aware that its trigger words are broad and could cause accidental activation; narrowing the triggers would improve routing quality.
The trigger list includes extremely broad generic terms like "nano", "banana", "pro", "generate", "edit", and "images", which are likely to appear in many unrelated user requests. This can cause unintended activation of the skill, leading to prompt-routing confusion, skill overshadowing, and execution of guidance outside its intended scope.
The trigger list includes very broad, common terms such as "nano," "banana," "pro," "generate," "edit," and "images," which can cause this skill to activate for many unrelated user requests. Over-broad activation can route users into the wrong workflow, increasing the chance of irrelevant guidance, unintended task handling, or interference with more appropriate skills.
The trigger set is overly generic, including broad tokens like "nano," "banana," "pro," and common request patterns such as asking for a practical workflow. This can cause unintended activation for unrelated user requests, leading the wrong skill to intercept conversations and produce irrelevant or misleading workflow guidance.
The trigger examples are broad, keyword-heavy, and likely to match many unrelated user requests such as generic 'help me' or common words like 'nano', 'banana', or 'pro'. In an agent ecosystem, over-broad activation can cause the wrong skill to engage, leading to prompt hijacking of user workflows, irrelevant instruction injection, or accidental processing in contexts the user did not intend.
The trigger keywords and example invocations are excessively broad, including generic terms such as 'nano', 'pro', 'generate', 'edit', and 'images'. This can cause the skill to activate in unrelated contexts, leading to misrouting, unintended execution, or prompt-scope hijacking where a user request is captured by this skill without clear intent.
The invocation description says to use the skill when a user asks for broad terms like work-productivity, nano, banana, or pro, or when they need almost any practical workflow, checklist, analysis, or implementation support. This ambiguity makes the activation boundary unclear and increases the chance the skill is selected for many unrelated requests, which can misroute user tasks and interfere with safer or more appropriate skills.
该技能文件为 SKILL.zh-CN.md，全文内容以简体中文面向 zh-CN 区域呈现，但文中未说明这是用户可选语言，也未提供语言选择机制或地区性合规理由。根据策略，若技能强制特定语言而没有用户选择或合理说明，可能构成语言/locale 政策问题。
The skill description says it should be used when users ask for broad terms like work-productivity, nano, banana, or pro, or whenever they need practical workflow or implementation support for the requirement. This scope is too vague and expansive, which makes accidental invocation likely and reduces assurance that the skill will only handle relevant requests.
The default prompt is broadly worded and includes many generic terms, which can cause the skill to be invoked in situations not specifically intended by the user. Because implicit invocation is enabled, this increases the chance of accidental routing, confusing behavior, and exposure of the skill in unrelated contexts.
The file descriptions specify 'English' and 'Chinese' skill instructions and guides, but the README does not state that users can choose their preferred language or that locale selection is optional. This can be a natural-language policy issue if the skill experience implies fixed language handling without explicit user opt-in.
In this Chinese-language README, the keywords and trigger phrases are presented primarily in English, such as 'Help me' and 'I need a practical workflow', which can effectively force a specific language for invocation. There is no explicit statement that users may invoke the skill in Chinese or choose their preferred language.
