Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with no code execution or data access, though its automatic activation wording is overly broad.
This skill is reasonable to install if you want a lightweight workflow helper, but expect it may activate on vague productivity or task-related prompts unless the platform or publisher narrows its triggers or disables implicit invocation.
The trigger phrases are broad, generic, and partially duplicated from the requirement text, which can cause the skill to activate in contexts the user did not intend. In an agent ecosystem, ambiguous activation can misroute tasks, override more appropriate skills, or cause unintended workflow execution, reducing safety and predictability.
The trigger phrases are broad, generic, and partially malformed, increasing the chance that the skill activates on unrelated user requests. In an agent ecosystem, unintended activation can cause workflow hijacking, user confusion, or the application of this skill's instructions when a more appropriate skill should have handled the request.
The manifest description says to use the skill when a user asks for broad concepts like 'work-productivity', 'proactive', 'transform', or 'task', which is ambiguous invocation guidance. In agent ecosystems, broad matching language can lead to accidental routing or over-selection of this skill for unrelated prompts, creating reliability and prompt-scope risks.
The trigger list contains very generic terms such as 'task', 'transform', 'needs', and 'partners' that overlap with normal user language. This can cause the skill to activate in many unrelated contexts, increasing the chance that it intercepts requests it was not intended to handle and influences agent behavior unexpectedly.
The trigger phrases are broad, natural-language sentences that overlap with common user requests such as asking for help or a practical workflow. This can cause the skill to activate unintentionally in contexts where the user did not explicitly request it, leading to misrouting, confusion, or inappropriate application of the skill's workflow.
The file descriptions specify separate English and Chinese instruction files, but this README does not state that the user can choose their preferred language or that language selection is optional. That can imply a fixed locale behavior without explicit user opt-in.
In a file named 'README.zh-CN.md', key usage guidance and trigger phrases are presented in English rather than giving the user a language choice or clearly documenting the constraint. This can amount to forcing a specific language/locale behavior without user opt-in.
The trigger list includes very generic terms such as "task", "needs", and "transform", which are likely to appear in normal user requests unrelated to this skill. This can cause unintended skill activation, routing user input into the wrong workflow and increasing the chance of irrelevant actions, confusion, or unsafe automation being applied out of context.
The skill name, short description, and default prompt are highly broad and repetitive, using generic terms like 'work-productivity,' 'proactive,' 'task,' 'workflow,' and 'help me' without clear boundaries. This can cause the platform to invoke the skill in contexts beyond its intended scope, increasing the chance of inappropriate activation, user confusion, or unintended influence over unrelated tasks.
Enabling implicit invocation while the skill remains broadly described makes unsolicited or weak-signal activation more likely. In this context, the skill is designed as a general workflow helper, so automatic triggering could insert the skill into unrelated conversations and steer outputs without clear user intent.
