Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overly broad activation wording but no hidden code, persistence, credential use, or destructive behavior.
Installers should be aware that this skill may activate too often because its triggers include generic terms and implicit invocation is enabled. It is otherwise low risk from the inspected artifacts; consider tightening activation wording or using explicit invocation if precise routing matters.
The documented trigger phrases are extremely broad and resemble ordinary user requests such as asking for 'a practical workflow' or general help. This can cause the skill to activate unintentionally in unrelated contexts, leading to prompt/skill hijacking, incorrect tool routing, or unnecessary exposure of the skill's instructions in conversations where the user did not explicitly request it.
The skill description is extremely broad and matches common requests like workflow help, checklists, analysis, implementation support, and several generic domains. This can cause the skill to activate for many unrelated prompts, increasing the chance that users are routed into an unintended workflow and that higher-priority or safer specialized skills are bypassed.
The trigger keywords include highly generic terms such as 'knowledge,' 'graph,' 'structured,' 'creating,' and 'bug fix,' which are likely to appear in many benign or unrelated user requests. Combined with permissive example triggers, this creates overmatching behavior that can hijack normal routing and invoke the skill in contexts far outside its intended domain.
The invocation description says to use the skill when a user asks for broad categories like work-productivity, ontology, typed, knowledge, or graph, without clear limiting conditions. This ambiguous activation scope increases the chance of accidental selection in unrelated contexts, which can override better-matched skills or introduce irrelevant workflow guidance.
The trigger keyword list is very broad and includes generic terms like "knowledge", "graph", "structured", and "creating", which are likely to match many unrelated user requests. This can cause the skill to activate outside its intended scope, leading to unintended instruction injection into unrelated tasks and reducing routing reliability.
The trigger sentence is broad and natural-language-like enough that ordinary user requests could unintentionally activate this skill outside its intended scope. In an agent ecosystem, overbroad activation can route unrelated tasks into a workflow that makes assumptions, produces irrelevant outputs, or bypasses more appropriate/specialized skills, creating reliability and safety issues.
The trigger phrases are broad, generic, and likely to match ordinary user requests such as asking for a practical workflow or help with bug fixing/hardening. In an agent ecosystem, this can cause unintended auto-activation of the skill in contexts the user did not intend, leading to confusing behavior, context hijacking, or inappropriate application of this skill's workflow over more suitable tools.
This Chinese-language README contains core descriptive content in English, which effectively imposes a language choice on the user without opt-in. The file does not explain that English is required or offer an alternative language/locale option for those sections.
The example trigger phrases are natural-language patterns that closely resemble ordinary requests and do not meaningfully constrain activation. If used by routing systems or copied as guidance, they can encourage overbroad matching and increase false activations across common productivity or implementation questions.
The skill’s default prompt is broad and underspecified, and allow_implicit_invocation: true permits the platform to activate the skill without an explicit user request. That combination increases the chance of unintended invocation in unrelated contexts, which can cause prompt-scope confusion, unnecessary data exposure to the skill, or unreliable behavior when the agent applies the skill beyond its intended domain.
This activation text is still ambiguous about when the skill should be invoked, so generic requests for a 'practical workflow' could match even when the user does not want ontology-typed workflow assistance. That ambiguity increases the chance of misrouting, which is especially risky in autonomous or semi-autonomous agent selection systems that rely heavily on trigger phrases.
The file lists separate English and Chinese skill and README variants, but it does not state that the user may choose their preferred language or that language selection is opt-in. This can create ambiguity around whether the skill may default to a specific language without user choice, which is a locale-policy concern.
No suspicious patterns detected.
