Security audit
Security checks for vulnerabilities and agentic risk
This documentation-only workflow helper has overly broad activation wording, but it shows no hidden code, data access, persistence, or destructive behavior.
Install only if you want a Skill Vetter workflow helper, and be aware it may trigger too often because of generic keywords. Consider narrowing the triggers before regular use.
The skill description says to use the skill when a user asks for very generic terms such as "security" and "first," which are common in unrelated conversations. This makes accidental or unnecessary activation likely, causing the agent to inject this workflow into contexts the user did not intend and potentially overriding more appropriate, narrower skills.
The keyword list includes vague terms like "security," "first," "before," and "github," all of which are broadly used across many benign requests. Such generic activation criteria can cause pervasive false triggering, leading to skill misrouting, user confusion, and unintended disclosure or processing under the wrong workflow.
The trigger list is excessively broad for a skill, including generic terms like 'security', 'first', 'before', 'github', and 'bug fix' that can appear in many unrelated user requests. This can cause unintended activation and route conversations into this skill when the user did not intend it, increasing the chance of incorrect guidance, scope hijacking, or interference with higher-priority skills in security-sensitive workflows.
The default prompt includes very broad, everyday trigger terms such as 'help me' alongside generic productivity and security-related language, which can cause the skill to be invoked in contexts the user did not clearly intend. Because implicit invocation is enabled, this increases the chance of accidental routing of unrelated user requests into this skill, potentially exposing user data or causing the agent to apply the wrong workflow.
The trigger phrases and keywords are broad enough to activate on generic terms like 'security', 'first', 'before', or 'github', which can cause the skill to run in contexts unrelated to its intended purpose. In a vetting/security-oriented workflow, accidental activation is more dangerous because it may override a more appropriate skill, mislead users into trusting an irrelevant workflow, or expand the skill's operational scope beyond what was reviewed.
The trigger examples use generic terms such as "security", "github", "before", and "bug fix", which creates ambiguous activation boundaries and increases the chance this skill is invoked for unrelated requests. In a security-oriented vetting workflow, accidental over-triggering is risky because it can steer users into the wrong workflow, produce irrelevant guidance, or preempt more appropriate safety checks and specialized skills.
The example trigger sentences reinforce ambiguous activation by using malformed, overly broad prompts that do not distinguish this skill from ordinary requests. Because examples often shape downstream routing behavior and developer expectations, unclear examples increase the chance of systematic over-activation.
The description activates on a very broad class of requests such as users asking for 'work-productivity', 'security', or practical support artifacts, without a clearly bounded scope. Ambiguous activation criteria make the skill eligible in many contexts beyond its intended purpose, which can lead to accidental invocation and unreliable or unsafe workflow selection.
The trigger sentences and keywords are broad enough to match common terms like 'security', 'first', 'before', and 'github', which can cause the skill to activate in unrelated contexts. In an agent environment, unintended invocation can route user requests into the wrong workflow, producing incorrect actions, irrelevant outputs, or accidental handling of sensitive tasks under the wrong procedure.
