Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper that teaches bounded proactive-agent design and does not install code, run commands, or request credentials.
Installers should know this skill may be invoked for broad workflow or automation wording, so use it when you actually want proactive-agent workflow design with approval gates and auditability. Review generated workflows before applying them to external sends, purchases, account changes, destructive edits, or public publishing.
The trigger sentences are extremely broad and match ordinary help requests such as asking for a practical workflow or general assistance. This can cause the skill to activate outside its intended scope, leading to inappropriate proactive behavior, misleading task routing, or accidental application in contexts where permissions, evidence, or user intent have not been clearly established.
This Chinese README includes the applicability description in English ('agent builders, operations teams...') rather than consistently matching the document locale or offering user language choice. That can violate language/locale expectations because the skill content implicitly mixes languages without opt-in or justification.
The trigger list is broad and composed of common productivity terms such as 'automation', 'notifications', and 'workflow', which can cause the skill to be invoked for many unrelated requests. Unintended invocation is risky because it can inject proactive-agent guidance into contexts where it was not requested, increasing the chance of mis-scoped automation recommendations or inappropriate handling of user tasks.
The trigger list is broad and lacks explicit scope constraints, so the skill may activate for many generic productivity or automation-related requests that do not actually need this capability. In an agentic workflow context, over-triggering can cause inappropriate guidance, unnecessary workflow automation suggestions, or bypass of better-matched skills, increasing the chance of unsafe or confusing outcomes.
The skill metadata uses broad activation language such as designing proactive workflows for notifications, automation, approvals, documentation, and review support, while also enabling implicit invocation. This can cause the skill to be selected in overly broad situations, increasing the chance that an agent applies proactive or semi-autonomous behavior without sufficiently narrow task boundaries or user intent confirmation.
The activation guidance does not define clear boundaries for when the skill should or should not be used, despite the skill being about proactive workflows that may influence actions and coordination. Without explicit exclusions and scope checks, an orchestrator or user may invoke it for generic productivity requests, increasing the risk of overreach, poor task selection, and outputs that appear authorized or contextually validated when they are not.
该文件为 SKILL.zh-CN.md，全文以中文呈现，但文档中未说明这是可选语言版本，也未向用户提供语言偏好选择或切换说明。若此内容直接面向终端用户，可能构成未获用户选择即强制特定语言/区域设置的自然语言政策问题。
