Productivity Operating System

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:01 PM UTC
• Version: 1.0.0

Overview

This is a plain Markdown productivity coaching skill with broad trigger phrases but no hidden code, persistence, credential handling, or unsafe behavior.

This skill is appropriate to install if you want an agent to help with personal productivity planning. Be aware that some trigger examples are common phrases, so it may activate for general planning requests; review outputs before adopting health, burnout, scheduling, or automation advice as personal guidance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README suggests invoking the skill with "Set up my productivity system," which is a fairly broad natural-language phrase rather than a narrowly scoped command. Without explicit constraints or negative examples, this could overlap with ordinary planning or self-improvement requests and cause unintended invocation.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 565)May include surrounding context.

md

ntum

### Multiple Projects / Side Hustles
- Max 2 deep-focus contexts per day (morning = Project A, evening = Project B)
- Different physical spaces if possible (desk = day job, table = side project)
- Weekly allocation: decide hours per project BEFORE the week starts
- One must-win PER PROJECT, not per day

### High-Meeting-Load Roles
- Cluster all meetings into 2-3 days. Protect remaining days fiercely
- 25-min default (not 30). 50-min default (not 60)
- Cancel bottom 20% of recurring meetings quarterly
- Standing meetings: review necessity monthly

---

## Natural Language Commands

The user can say things like:
- "Plan my day" → Run Phase 2 + 3, create time blocks
- "What should I work on?" → Priority scoring (Phase 2)
- "I can't focus" → Procrastination diagnostic (Phase 10)
- "Am I burning out?" → Burnout assessment (Phase 6)
- "Review my week" → Weekly review questions (Phase 4)
- "Help me plan next week" → Weekly planning (Phase 4)
- "How productive was I?" → Dai

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill defines very broad natural-language triggers such as 'Plan my day', 'What should I work on?', and 'Help me plan next week', which are common everyday phrases that can overlap with many unrelated user requests. In an agent routing context, this can cause accidental invocation or over-selection of this skill, leading to unintended access to user context and misrouting of tasks away from more appropriate, specialized skills.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.