Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed cost-control helper with some overly broad activation wording, but no hidden code, persistence, data exfiltration, or destructive behavior.
Before installing, be aware that this skill may activate often for credit, file-processing, failed-task, or vague-task conversations. It is best suited for users who want frequent cost checks and confirmation gates before expensive work; users who prefer fewer interruptions should narrow the triggers.
The trigger list contains very broad phrases such as '积分', '任务失败', and '没做出来', which can match many unrelated user messages. This can cause the skill to activate unexpectedly across ordinary conversations, increasing the chance of workflow hijacking, unwanted interception, and unnecessary tool-routing decisions.
The activation logic is ambiguously defined with broad conditions like file handling, batch generation, agent tasks, or prior expensive failures, all of which are common across normal usage. Because the skill says to '立即加载' under these conditions, it can preemptively insert itself into many benign tasks and alter execution flow without clear user intent.
Using the single-word trigger '积分' is overly broad because it is a common term likely to appear in many unrelated platform discussions. This creates accidental activation risk and makes the skill easier to invoke unintentionally, especially in contexts where users are merely asking about balances, pricing, or past usage rather than requesting cost-guard behavior.
No suspicious patterns detected.
