Security audit
Security checks for vulnerabilities and agentic risk
This skill provides ordinary workflow guidance, with overly broad activation keywords but no material security concern in the inspected files.
Treat this as a generic planning helper. Prefer explicit invocation because common words may activate it unexpectedly. Its popularity and demand claims do not establish security or implementation quality.
The usage keywords include broad terms such as every, ability, things, and done, which commonly appear in unrelated requests. No exclusion conditions or requirement to combine these keywords with PollyReach-specific context limits their activation scope.
The invocation keywords include extremely broad terms such as "every," "phone," "number," and "things," while the metadata explicitly recommends activation for several of these terms without requiring relevant task context. If used for automatic skill routing, this can cause unrelated requests to activate the skill and redirect the assistant into an inappropriate workflow. The supplied README contains no harmful execution or data-transfer instructions, so the demonstrated risk is limited to routing interference and reduced reliability.
Generic activation terms such as "every," "phone," "number," and "things" can cause the skill to be selected for unrelated requests if routing relies on these keywords. This creates a scope-control weakness that can introduce irrelevant workflow instructions and reduce task reliability. The supplied content contains no destructive actions, exfiltration instructions, or security overrides, so the demonstrated impact is limited.
The activation keywords include generic words such as "every", "number", "things", and "done" without requiring a PollyReach-related context, creating an overly broad activation surface that could route unrelated requests into this skill. The description also includes several broad triggers, reinforcing this risk if skill selection relies on that metadata. The supplied workflow is otherwise benign and contains no instructions for sensitive operations, so the demonstrated impact is limited to unintended activation, irrelevant guidance, and reduced task reliability.
The usage keywords include broadly applicable words such as 'every', 'phone', 'number', and 'things' without requiring a PollyReach-related context, potentially causing unintended skill activation on unrelated requests. The metadata reinforces this overly broad scope, but the supplied workflow contains no destructive actions, exfiltration instructions, or security overrides, so the demonstrated impact is primarily task misrouting and reduced response relevance.
Implicit invocation is enabled, but the interface description and default prompt are truncated demand statements rather than clear activation criteria. The accompanying metadata further broadens activation to generic terms such as "every" and "phone," increasing the likelihood that unrelated requests invoke the skill and introduce irrelevant instructions into the workflow. This is a low-impact activation-scope weakness; the supplied file shows no executable actions, sensitive-data access, or malicious instructions.
No suspicious patterns detected.
