Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow helper with overbroad activation wording, but it does not request credentials, execute code, persist changes, or access sensitive data.
Install only if you want a general SkillScan-style security workflow helper. Be aware it may be selected too often because the activation terms include generic words like security, must, before, and bug fix; tighter triggers would reduce confusion.
The trigger phrases are broad, natural-language requests that can match ordinary user prompts unrelated to this specific skill. This increases the chance of accidental activation, causing the agent to invoke security/workflow behavior outside intended scope and potentially override more appropriate skills or inject irrelevant process steps into unrelated tasks.
The manifest description says to use the skill when a user asks for broad topics like "work-productivity," "security," or "needs a practical workflow," which are common across many unrelated requests. This ambiguous invocation condition increases the chance of inappropriate auto-selection and can interfere with safer or more relevant skills by over-claiming a wide portion of normal conversation.
The trigger keyword list is extremely broad and includes common terms such as "security," "every," "must," "before," and "bug fix," which are likely to appear in ordinary user conversations unrelated to this skill. That makes accidental invocation plausible, causing unintended routing, context pollution, or the skill being applied outside its intended scope.
The trigger keyword list is overly broad and includes common terms such as "security", "must", "pass", and "before", which can cause the skill to activate in many unrelated conversations. In an agent environment, unintended invocation can override more appropriate skills, expose users to irrelevant automation, and create prompt-routing instability that may be abused to steer workflows unexpectedly.
Enabling implicit invocation without narrowly constrained criteria allows the platform to auto-select this skill based on vague relevance rather than explicit user intent. Because this skill advertises a wide set of productivity and security-related functions, accidental activation could route sensitive prompts or operational decisions through the skill unexpectedly, which is especially risky in security-oriented workflows where correctness and least-privilege routing matter.
The trigger sentences are broad, natural-language phrases that overlap with ordinary user requests about help, workflows, bug fixing, and hardening. This increases the chance of unintended skill activation, which can route users into the wrong workflow, create confusing or unsafe execution paths, and make downstream security-sensitive behavior easier to invoke accidentally.
The keyword list includes generic terms such as 'security', 'gate', 'every', 'must', 'pass', 'before', 'activate', and 'bug fix', which are common across many benign requests. Ambiguous activation logic can cause over-triggering, making the skill fire in unrelated contexts and creating routing confusion, unintended authority, or denial of more relevant skills.
The example trigger sentences model vague activation behavior by repeating broad requirement text instead of showing precise, bounded user intents. This reinforces overbroad matching patterns and makes implementers more likely to preserve or extend unsafe activation logic.
该文件名为 SKILL.zh-CN.md，正文也整体以简体中文呈现，但内容中未说明这是可选语言版本，也未向用户提供语言切换或选择机制。若技能默认强制使用特定语言/地区而无用户选择，可能构成语言/locale 策略问题。
The description defines usage conditions very broadly, covering generic requests for workflows, artifacts, checklists, analysis, or implementation support around several common topics. This ambiguity increases the chance of accidental selection and can make the skill compete with unrelated skills, reducing reliability and opening the door to prompt-routing misuse.
The manifest text is extremely broad and generic, describing many unrelated user intents such as workflows, checklists, analysis, and implementation support without clear activation boundaries. In systems that allow implicit tool or skill routing, this can cause the skill to be invoked in contexts the user did not specifically intend, increasing the chance of prompt-scope confusion, unintended data exposure to the skill, or unsafe delegation.
The trigger sentence is broad enough to match ordinary user requests about general help, workflows, bug fixing, or hardening rather than a narrowly scoped invocation. This can cause unintended skill activation, which is dangerous because it may route user requests into an unexpected workflow, override more appropriate skills, or expand the skill's operational reach beyond what the user intended.
This request pattern is phrased so generally that many unrelated requests for a 'practical workflow' could activate the skill despite lacking clear user intent to use this specific capability. In an agent ecosystem, ambiguous activation increases the risk of misrouting, over-broad tool use, and unsafe automation paths being selected without sufficiently precise consent or context.
