Security audit
Security checks for vulnerabilities and agentic risk
This skill offers ordinary workflow guidance, with broad activation keywords that may cause irrelevant selection but no material security concern in the inspected files.
Expect general planning guidance. Use explicit invocation to avoid unwanted selection, and review any generated automation against your actual task before running it.
The usage section lists broad keywords that can occur in unrelated requests, without explaining whether they independently activate the skill. Although longer trigger sentences are provided, there are no exclusions or contextual requirements limiting these keywords to Proactive Agent workflow assistance.
The trigger list includes everyday words such as task, needs, transform, followers, and partners, which can occur in requests unrelated to proactive-agent workflows. Line 4 reinforces this broad activation scope, and the skill provides no exclusion conditions to prevent unintended invocation.
The trigger list includes broad terms such as task, transform, needs, followers, and partners, which commonly appear in unrelated requests. Line 4 also authorizes activation on generic keywords, and the skill provides no exclusions or requirement that these terms occur in a proactive-agent context.
Implicit invocation is enabled while the supplied skill description includes broad activation terms such as "task," "transform," and "proactive," which could cause the skill to activate on unrelated requests. This creates a routing and instruction-scope weakness, but the provided YAML contains no executable actions, sensitive-data access, or malicious instructions, so direct security impact is limited on the available evidence.
The usage keywords include broad terms such as 'task', 'needs', and 'transform' without requiring a connection to Proactive Agent workflows. If used for automatic skill selection, these triggers could activate this skill for unrelated requests, displacing more appropriate skills and introducing irrelevant workflow instructions. The risk is limited because the supplied content describes ordinary planning and validation, with no instructions for privileged execution, data disclosure, or destructive actions.
Generic activation terms such as 'task', 'transform', and 'needs' can cause this skill to be selected for unrelated requests if keyword-based routing is used. This creates a low-impact scope-control weakness that could divert the assistant from the user's intended workflow, although the provided README contains no malicious execution instructions or evidence of data exposure.
