SG-076: Skill description semantic lure
Severity: HIGH
Skill `description:` contains broadening phrase ('any time', 'always', 'whenever') that triggers auto-invocation on nearly every user prompt, combined with model invocation NOT disabled.
Fires when
- Skill `description:` contains a broadening phrase like 'any time', 'always', 'whenever', or 'every time'.
- Model auto-invocation is not disabled (no `disable-model-invocation: true`), so the skill loads on nearly every matching prompt.
- Severity escalates to HIGH when the description also names a safety-sensitive topic (auth, secrets, deploy, git, IAM, cloud).
Remediation
Narrow the skill's `description:` to the specific task it handles (e.g. 'Use when the user asks about Stripe billing'). Remove broadening phrases like 'any time', 'always', 'whenever', 'every time'. If the skill genuinely should auto-invoke broadly, set `disable-model-invocation: true` and let the user invoke it explicitly by name.