Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overly broad activation wording, but it does not request credentials, persistence, network execution, or privileged local access.
Installers should be aware that this skill may activate too easily on ordinary PDF, editing, or workflow requests. It appears safe as a documentation-only helper, but its trigger wording should ideally be narrowed to explicit Nano Pdf workflow requests to avoid accidental use.
The trigger sentence is broad enough to match common user phrasing about help, workflows, or PDF editing, which can cause unintended skill activation. In an agent environment, overbroad activation can inject this skill's instructions or workflow into unrelated tasks, creating prompt-routing confusion and potentially unsafe or incorrect task handling.
The trigger phrases are broad enough to match ordinary requests about PDFs, editing, or practical workflows, which can cause the skill to activate outside its intended scope. In an agent ecosystem, this creates prompt-routing confusion and increases the chance that unrelated user requests are handled by the wrong skill, reducing reliability and potentially exposing users to unintended instructions or behaviors.
The manifest description uses expansive activation wording like "Use when a user asks for work-productivity, nano-pdf, nano, pdf, edit, or needs a practical workflow, artifact, checklist, analysis, or implementation support," which is so general that it overlaps with many normal tasks. In systems that use descriptions for routing, this broad scope can capture unrelated requests and cause the wrong skill to be selected.
The trigger keyword list is excessively broad and includes generic terms such as "nano," "pdf," "edit," "natural," and "language," which are likely to match many unrelated user requests. This can cause unintended auto-invocation of the skill, leading to prompt-routing errors, inappropriate context injection, and reduced trust in agent behavior.
触发关键词包含非常通用的词，如“nano”“pdf”“edit”“natural”“language”“instructions”，会让该技能在大量无关对话中被误触发。误触发会扩大技能的执行面，导致错误路由、无关上下文注入，且在涉及文件处理或工作流建议时可能干扰用户原本任务。
The trigger sentence is broad and resembles ordinary user language, which can cause the skill to activate in contexts where the user did not explicitly intend to invoke it. Unintended invocation is dangerous because it can route unrelated requests into this workflow, causing incorrect task handling, prompt-surface expansion, and possible chaining into other risky skill behaviors.
The invocation guidance does not define clear boundaries for when the skill should or should not run, and the listed keywords are generic terms like 'pdf', 'edit', and 'instructions'. This increases the chance of accidental or excessive routing to the skill, which can override more appropriate skills or cause unintended processing of unrelated user requests.
The file descriptions explicitly label separate English and Chinese documentation variants, and this file itself is a Chinese-language README without any indication of user language choice or opt-in. This can create a language/locale policy issue if the skill experience defaults users into a specific language without offering selection.
The example trigger sentences reinforce vague matching behavior by showing activation from broad, reusable phrasing rather than precise, constrained user intents. This increases the chance that downstream authors or routers will treat almost any vaguely similar request as eligible for this skill.
技能描述中的激活条件覆盖面过宽：只要用户提到若干常见词或需要“流程、产物、检查清单、分析或实现支持”就可能触发，缺乏明确边界。这样的模糊触发条件会使技能在与其目标场景不匹配的请求中被调用，增加误用和不恰当建议的风险。
示例触发句基本重复需求宣传语，缺少与相邻技能或普通自然语言请求的区分边界，无法为路由器提供可靠约束。结果是系统可能学习到过于宽泛的触发模式，从而提升误召回率。
The default prompt includes broad, everyday trigger terms such as 'help me' and generic workflow language that can cause the skill to activate in situations far beyond its intended Nano PDF niche. Because implicit invocation is also enabled, this increases the chance of accidental routing, prompt hijacking opportunities, or user confusion about which skill is acting on a request.
The trigger section lacks precise activation boundaries and uses ambiguous examples like common productivity/help phrasing, increasing the chance of accidental routing. In an agent ecosystem, ambiguous routing is security-relevant because it can override more appropriate skills, broaden exposure to adversarial prompts, and make system behavior less predictable.
