Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-style workflow helper with overbroad activation wording, but no evidence of hidden execution, data access, persistence, or destructive behavior.
Install only if you want a general workflow helper for self-improving agent reliability tasks. Be aware that its trigger wording is broad, so it may be invoked for ordinary bug-fixing or productivity requests where a narrower skill would be more appropriate.
The skill description is broad and includes generic concepts like 'help users,' 'practical workflow,' 'artifact,' and 'analysis,' which can match many unrelated requests. This increases the chance the skill is invoked outside its intended scope, causing prompt-routing confusion and potentially exposing users to inappropriate automation or agent behavior where a narrower skill should have been used.
The keyword list contains extremely generic tokens such as 'self,' 'improving,' 'errors,' and 'enable' that appear in ordinary conversation. These low-specificity triggers make unintended activation very likely, which can hijack routing away from more appropriate skills and create unsafe or unreliable task handling.
The trigger list includes extremely broad everyday terms such as "self", "improving", "enable", and "bug fix", which can match many unrelated user requests and cause the skill to activate unintentionally. In an agent ecosystem, overbroad auto-invocation can redirect workflows, inject irrelevant instructions into unrelated tasks, and increase the chance that a lower-scope skill influences sensitive operations it was not meant to handle.
The skill enables implicit invocation while its display name, short description, and default prompt are broad and vague, covering generic 'work-productivity' and 'self-improving' workflow help rather than a narrowly scoped task. This can cause the platform to auto-select the skill in contexts the user did not clearly intend, increasing the chance of prompt-surface expansion, unintended actions, or exposure to adversarial instructions embedded in the skill.
The trigger examples include very broad, natural-language phrasing such as 'Help me' and 'I need a practical workflow', which can match many ordinary user requests unrelated to this specific skill. This creates a real risk of unintended skill invocation, causing the agent to apply the wrong workflow, override more appropriate skills, or expose users to irrelevant or misleading automation behavior.
The trigger examples use generic natural-language phrases such as 'Help me' and 'I need a practical workflow' combined with broadly applicable terms like 'fixing bugs,' which can match many ordinary user requests outside the intended scope. This can cause accidental skill invocation, leading the agent to apply the wrong workflow, override user intent, or expose unrelated context to a skill that was not explicitly requested.
The trigger phrases are broad, generic, and include common words such as 'self', 'improving', 'errors', and 'bug fix', which can cause the skill to activate for many unrelated user requests. In an agent ecosystem, this increases the chance of unintended routing or invocation, causing the skill to intercept conversations outside its intended scope and potentially influence workflows it was not meant to handle.
The example trigger sentences are phrased in a way that resembles normal user requests and repeat broad language from the requirement statement. This can train or bias invocation systems toward matching commonplace phrasing, further increasing accidental activation frequency.
The description says the skill should be used when users mention broad terms like work-productivity, self, improving, or captures, which leaves activation boundaries unclear and materially widens the scope of applicability. This ambiguity increases accidental invocation risk and can cause the agent to apply this workflow in contexts where it is irrelevant, reducing reliability and potentially overriding more appropriate skills.
