Security audit

discussion-conventions-diagnosis

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only academic writing diagnostic skill with no executable behavior; the only notable issue is that some trigger phrases are broad enough to activate outside its niche.

This skill appears safe to install for academic writing diagnostics. Users should be aware that generic requests like "check conventions" may invoke it unintentionally, so prompts should mention psychology papers or Discussion-section conventions when that is the intended use.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes broad phrases such as "check conventions" that may activate the skill outside its intended narrow context. In an agent system, overly broad activation can cause misrouting, unintended invocation on unrelated user inputs, and unreliable behavior, though this skill’s read-only diagnostic scope limits direct security impact.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrase "check conventions" is broad enough to match many unrelated user requests about rules, norms, or formatting, which can cause the skill to activate outside its intended niche of psychology Discussion sections. Over-broad activation expands the skill's effective authority and can lead to misrouting, confusing outputs, or unintended handling of content better served by another skill.

Vague Triggers

Low

Confidence: 77% confidence
Finding: The phrase "contribution statement" is ambiguous because it can refer to many academic contexts, including author contributions, grant statements, thesis sections, or general writing help. This ambiguity may trigger the skill in contexts where its diagnostic criteria do not apply, creating accidental invocation and degraded routing quality.

Static analysis

No suspicious patterns detected.