Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrow UIBC judging aid with a small local checker and no evidence of hidden access, persistence, credential handling, or external execution.
Installers should understand that this skill may be invoked around UIBC or crypto-asset judging language, so it is best used only for TH-CRYPT-001 migration/accountability analysis rather than ordinary crypto or finance questions.
Line L06 lists short trigger terms such as “UIBC”, “加密资产”, and “参赛队”, which are broad enough to overlap with ordinary discussion of the domain rather than clearly signaling this specific skill. The file does not provide exclusion conditions or negative examples to distinguish when the skill should not activate.
The skill metadata advertises activation on broad terms such as UIBC, crypto assets, migration judgment, evidence package, and accountability without strong contextual constraints. This can cause the skill to be invoked for loosely related conversations, increasing the chance of irrelevant policy framing, domain overreach, or unintended handling of sensitive finance-adjacent requests.
The invocation guidance explicitly says to use the skill when users mention broad trigger words, but does not require confirmation that the user actually wants this specialized judging framework. In practice this can lead to accidental invocation, inappropriate application of a niche criterion set, and confusion in mixed-domain or ordinary crypto discussions.
