Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overly broad activation wording but no code execution, persistence, credential use, or hidden data access.
Before installing, be aware that this skill may activate too easily for generic productivity or self-improvement requests. It appears safe as a workflow helper, but maintainers should narrow the triggers to explicit self-improving/proactive agent workflow requests and clarify language selection behavior.
The trigger keywords and example invocations are broad enough to match common terms like 'self', 'improving', 'proactive', and generic requests for help, which can cause unintended skill activation. In an agent ecosystem, accidental invocation can route user tasks into the wrong workflow, creating confusion, improper task handling, or unsafe chaining with other automation behaviors.
The trigger list includes extremely generic terms such as "self," "improving," "proactive," and "learning," which are common in benign user requests far outside this skill’s intended scope. In an agent system that auto-selects skills from trigger phrases, this can cause unintended activation, prompt-shadowing of more appropriate skills, and execution of workflows on unrelated tasks, increasing the chance of unsafe or misleading outputs.
The trigger keywords include extremely broad generic terms such as "self", "improving", and "proactive", which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance of unintended tool routing, irrelevant workflow injection, and user confusion, especially because this skill claims a wide range of planning and implementation behaviors.
The trigger phrases are generic help-seeking prompts such as 'Help me' and 'I need a practical workflow', which can cause the skill to activate in many unrelated conversations. In an agent ecosystem, overly broad activation expands the skill's execution surface and can unexpectedly inject its instructions into contexts where the user did not specifically request this capability.
This file is presented as a Chinese README, but key user-facing content including the workflow description and trigger phrases is only in English. That creates an implicit language constraint without user opt-in or a documented reason, which can violate language/locale policy expectations.
The invocation description says to use the skill when a user asks for broad concepts like work-productivity, self, improving, or proactive, without clearly defining the task boundaries. This ambiguity can make the orchestrator invoke the skill for loosely related requests, causing scope creep, incorrect tool selection, and accidental interference with other skills better suited for the user’s intent.
文件名和全文内容表明该技能以 zh-CN 版本提供，但文中未见任何允许用户选择输出语言或说明仅在特定语言环境下适用的文字。若技能默认强制特定语言而不给用户选择，可能违反语言/locale 选择政策。
The activation condition in the description is ambiguous and broad, stating the skill should be used when users mention loosely related concepts or need general workflow, checklist, analysis, or implementation help. This weak boundary definition can cause accidental invocation in contexts outside the intended use case, creating misrouting risk and expanding the skill's effective authority.
The skill’s activation cues are very broad and generic, covering common terms like 'work-productivity', 'self', 'improving', and 'practical workflow', which can cause the skill to trigger in many unrelated contexts. Combined with implicit invocation, this increases the risk of unintended routing, prompt-scope expansion, and the application of this skill in contexts the user did not clearly request.
The trigger sentence is broad enough to match ordinary user phrasing such as general requests for 'practical help,' which can cause the skill to activate outside its intended scope. In an agent system, over-broad activation can route unrelated tasks into this skill, leading to prompt hijacking of workflow selection, reduced reliability, and accidental handling of requests the skill was not designed to process.
The phrase 'I need a practical workflow for ... They need practical help' lacks clear activation boundaries and is ambiguous enough to overlap with many benign user requests. This increases the chance of unintended skill invocation, which is especially risky for a proactive/self-improving workflow skill because accidental activation can influence downstream agent behavior and decision-making beyond the user's actual intent.
The natural-language description explicitly labels one set of instructions as English and another as Chinese, but the README does not state how the skill chooses language or that the user can opt in to a preferred locale. This can create ambiguity about default language behavior and may conflict with organizational expectations around user language choice.
