Security audit
Security checks for vulnerabilities and agentic risk
This is a prompt-only emotional companion and conversation-advice skill with broad trigger phrases but no code, dependencies, persistence, credential use, or hidden system access.
Installers should expect this skill to answer emotional-support, role-play, workplace communication, and social-script prompts. Be aware it may activate for generic 'how should I reply' style requests, so users should provide context and avoid sharing sensitive personal details unless they intend to receive conversation advice.
The Chinese trigger phrases are broad enough to match many ordinary requests like 'how should I reply' or 'how to say this,' which can cause the skill to activate outside its intended domain. In an agent ecosystem, overbroad activation can override more appropriate skills, leading to confused routing, privacy over-collection in sensitive conversations, or unintended emotional-roleplay behavior.
The English triggers include highly generic phrases like 'How to respond,' 'Chat tips,' and 'Conversation skills,' which are common across many unrelated tasks. This increases the chance of accidental invocation and misrouting, especially in multilingual environments where short English prompts are already ambiguous.
The intent-routing rule includes a catch-all for 'other emotional-related' input with automatic mode selection, which delegates undefined scope to the skill. Catch-all routing is dangerous because it expands authority beyond clearly specified use cases and can absorb sensitive or high-risk requests that should be handled by safer default behavior or specialized skills.
The quick trigger section repeats multiple vague activation phrases without exclusions, reinforcing the same overmatching problem and making opportunistic activation more likely. Repetition across trigger lists can bias simple routers or keyword matchers toward this skill even when another tool would be more appropriate.
