Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overly broad activation wording, but I found no hidden execution, persistence, credential handling, or destructive behavior.
Install only if you want a general workflow helper for self-improving or proactive agent work. Be aware that its broad triggers may cause it to activate unexpectedly; tighter trigger wording or explicit invocation would reduce confusion.
The description says to use the skill when a user asks for broad categories like "work-productivity" or needs any "practical workflow, artifact, checklist, analysis, or implementation support," which is vague enough to match many unrelated tasks. In an agentic environment, such ambiguity increases the chance of over-selection and lets this skill influence conversations beyond its legitimate domain.
The trigger list includes extremely broad terms like "self," "improving," and "proactive," which are common in unrelated user requests. This can cause the skill to activate outside its intended scope, leading to inappropriate routing, prompt interference with more relevant skills, and unpredictable agent behavior.
The trigger list includes extremely generic terms such as "self", "improving", "proactive", "learning", and "organizing", which are common in ordinary user requests and likely to cause unintended activation of this skill. Overbroad activation can route unrelated conversations into a self-improving/proactive workflow, increasing the chance of prompt misapplication, confusion, and accidental execution of higher-risk agent behaviors in contexts where the user did not ask for them.
The trigger phrases start with extremely common language such as "Help me" and "I need," which can cause the skill to activate on many unrelated user requests. In an agent ecosystem, unintended invocation can misroute tasks, override more appropriate skills, or inject workflow behavior into contexts where the user did not intend to use this skill.
The keyword list contains very generic terms such as 'self', 'improving', 'proactive', 'reflection', and 'bug fix', which are common across many benign conversations. This weak scoping can cause accidental routing to this skill, especially because the skill targets proactive and self-improving behaviors that may alter workflow or decision-making beyond user intent.
The trigger sentences are broad, natural-language phrases that could match ordinary user requests unrelated to this specific skill. This increases the chance of unintended activation, causing the agent to apply self-improving or proactive workflow behavior in the wrong context and potentially produce confusing, overreaching, or unsafe actions.
The trigger phrases are broad, generic, and include common help-seeking language that could match many ordinary user requests unrelated to this specific skill. In an agent skill-routing context, this can cause accidental invocation, misrouting, and unexpected execution of a self-improving/proactive workflow in situations where the user did not intend it.
The example triggers are generic requests that largely repeat the broad requirement text instead of demonstrating narrowly scoped invocation. This trains matching systems and maintainers toward overbroad activation patterns, increasing accidental use of the skill in irrelevant contexts.
The skill enables implicit invocation while using a very broad description and default prompt tied to generic terms like work productivity, self-improving, and practical help. This can cause the agent to invoke the skill in contexts the user did not explicitly request, increasing the risk of prompt-scope hijacking, unintended behavior changes, or unsafe delegation to an overly general workflow helper.
This Chinese-language README contains core user-facing content in English, including the main requirement description, without indicating that the user can choose their preferred language. That may conflict with a language/locale expectation for localized documentation because it effectively forces some content into English without opt-in.
