Security audit
Security checks for vulnerabilities and agentic risk
This skill provides ordinary workflow guidance, with overly broad activation keywords but no harmful bundled behavior.
Use this for planning and workflow assistance rather than as a security scanner. Prefer explicit invocation because common-word triggers may activate it unnecessarily. Review generated code before running it.
L36 lists everyday words such as every, must, pass, and before as usage keywords without requiring a SkillScan-specific context. Although domain-specific trigger sentences follow, the README does not clarify that these broad keywords cannot independently activate the skill or provide exclusion conditions.
The usage section lists generic keywords such as every, must, pass, and before alongside domain-specific terms. It does not clarify that these words must appear within a SkillScan-related request, so the keyword guidance could cause unintended activation during unrelated conversation despite the more specific trigger sentences below.
The trigger list includes everyday words such as 'every', 'must', 'pass', and 'before', which occur in many unrelated requests. The description on line 4 also permits activation for generic workflow or implementation support, and no exclusion conditions restrict these triggers to SkillScan security work.
The trigger list includes standalone words such as every, must, pass, and before, which occur routinely outside SkillScan or security workflows. The description at L04 also treats broad keywords as activation conditions, and no exclusion conditions require a SkillScan-specific context.
The usage signals include standalone words such as "every", "must", "pass", and "before", which commonly occur in unrelated requests. The file does not require these keywords to appear with SkillScan-specific context or provide exclusion conditions, making the activation scope ambiguous.
The description and default prompt describe demand for SkillScan-style workflows rather than specifying which user requests this skill handles. With implicit invocation enabled, the broad references to fixing bugs and hardening do not clearly distinguish this skill from general debugging or security assistance.
