Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overly broad activation wording but no hidden code, persistence, credential access, or destructive behavior.
Before installing, be aware that this skill may activate on fairly generic productivity or self-improvement requests. It is safest to invoke it explicitly by name when you want this workflow helper, and ignore or disable implicit activation if it routes unrelated tasks into this skill.
The trigger phrases are broad and include common terms such as 'self', 'improving', and 'proactive', which can cause the skill to activate in unrelated conversations. In an agent ecosystem, unintended invocation can route user input into the wrong workflow, producing irrelevant actions or outputs and increasing the chance of unsafe automation or prompt-scope confusion.
The description says to use the skill when a user asks for broad categories like work-productivity, self, improving, or proactive, which creates ambiguous activation conditions. In a skill-selection system, this can cause accidental invocation on many benign conversations, reducing predictability and potentially exposing users to irrelevant workflow guidance or unintended instruction precedence.
The trigger list includes generic terms like "self," "improving," and "proactive," which are common in ordinary user requests and can cause unintended activation. Over-broad routing increases the chance that this skill intercepts unrelated tasks, leading to incorrect behavior, prompt-surface expansion, and possible bypass of more appropriate domain-specific safeguards.
The trigger keywords include extremely broad everyday terms such as “self”, “improving”, and “proactive”, which can match many unrelated conversations and cause unintended activation of this skill. Over-broad invocation can route users into the wrong workflow, override more appropriate skills, and increase the chance that downstream automation is applied in an unintended context.
The trigger sentences are written in broad, natural language phrases such as 'Help me' and 'I need a practical workflow', which can match many ordinary user requests unrelated to this specific skill. That raises the chance of unintended invocation, causing the wrong skill to activate, produce irrelevant outputs, or bypass more appropriate specialized handling.
The trigger sentence starts with a very common help-seeking phrase ('Help me') and then appends broad topical language, making accidental or overly eager activation plausible. In agent ecosystems, vague triggers can cause the wrong skill to intercept unrelated user requests, leading to misrouting, unintended workflow execution, or prompt-space interference with other skills.
This trigger uses generic wording ('I need a practical workflow') that is common across many benign requests and does not clearly constrain when the skill should activate. Because the skill targets broad productivity and proactive-agent tasks, the context increases the chance of overmatching and unintentional invocation across unrelated tasks.
This is a Chinese README, but the only listed trigger phrases are in English ('Help me...', 'I need...'). That can create a language-policy issue by effectively requiring English invocation without stating that users may use Chinese or choose their preferred language.
The example trigger sentences are repetitive and extremely permissive, effectively teaching the router that nearly any mention of the requirement text should activate the skill. Because there are no negative examples or disambiguation cues, the examples reinforce over-matching and make accidental selection more likely.
The description says the skill should be used for a very broad set of requests, including generic concepts like work-productivity, self, improving, and proactive, without defining clear exclusion boundaries. This ambiguity makes accidental or excessive triggering more likely, which can misroute user requests and create unsafe autonomous behavior if the skill acts proactively outside its intended niche.
The default prompt activates the skill with a very broad phrase tied to generic productivity and self-improvement language, which can cause unintended invocation outside a narrowly defined use case. Because implicit invocation is also enabled, unrelated user requests may be routed into this skill, increasing the chance of prompt-context hijacking, unexpected behavior, or overreach into tasks the user did not explicitly request.
