Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with no code execution or data access, but its activation wording is too broad and may trigger in unrelated conversations.
Install only if you want a general Skill Vetter workflow helper. Consider narrowing or disabling implicit invocation so ordinary requests about security, GitHub, or bug fixes do not accidentally route through this skill.
The trigger list is overly broad, including generic terms like "security," "first," and "github," which can cause the skill to activate in many unrelated conversations. Unintended activation can override more appropriate skills or inject irrelevant workflow guidance into sensitive security discussions, reducing reliability and potentially affecting safety-critical routing.
The trigger list includes very generic terms like "security", "first", "before", and "github", which are common in unrelated conversations. This can cause unintended skill activation, routing user input into the wrong workflow and potentially exposing sensitive context or producing irrelevant security-style guidance when the user did not request it.
The trigger phrases are broad, generic, and include common terms like 'security', 'first', 'github', and 'bug fix', which can cause the skill to activate for unrelated user requests. In an agent-routing context, this creates prompt/skill overreach risk: the wrong workflow may be invoked, leading to irrelevant actions, confusion, or unsafe handling of tasks under an inappropriate security-oriented skill.
The trigger sentences and keywords are broad enough that ordinary requests involving generic terms like 'security', 'first', 'github', or 'bug fix' could invoke the skill unintentionally. In a workflow/helper skill, accidental invocation can route users into the wrong process, causing inappropriate actions, misleading analysis, or unnecessary exposure of unrelated user content to the skill's logic.
The trigger phrases are broad enough to match common terms like "security," "first," "before," "installing," and "github," which can cause the skill to activate for many unrelated user requests. In a security-oriented helper skill, over-triggering is risky because it can inject vetting or workflow guidance into contexts the user did not intend, increasing the chance of misrouting, confusion, or unintended handling of sensitive tasks.
The manifest description uses vague activation language like "help users" and "needs a practical workflow," which does not clearly constrain invocation scope. This ambiguity increases the chance of accidental selection in unrelated tasks, leading to misrouting and reduced trust in agent behavior.
The example trigger sentences are malformed and unrealistic, so they fail to establish clear invocation boundaries for routing systems or maintainers. Poor examples can reinforce incorrect matching behavior and increase accidental or inconsistent activation.
The activation description says to use the skill for broad topics like work-productivity, security, or practical workflow support, without enough boundary conditions. That ambiguity increases accidental invocation risk and can make the assistant choose this skill in contexts far outside its intended vetting workflow.
This localized zh-CN skill presents trigger keywords and example utterances primarily in English, which can impose an English-language interaction pattern despite the file otherwise being Chinese. There is no statement that users may choose their preferred language or that English is required for a justified reason.
The default prompt contains broad, common-language triggers such as 'help me' and generic productivity/security workflow wording, which can cause unintended invocation outside narrow intended use cases. Because implicit invocation is enabled, this increases the chance the skill activates on unrelated user requests and injects its workflow into conversations without clear user intent.
