Security audit

13-Day Sprint Method - Productivity System

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only productivity calendar skill with some planning-example inconsistencies, but no evidence of malicious behavior or special system access.

Reasonable to install as a productivity guide. Treat its calendar examples as advisory and verify dates before relying on them for important deadlines, deployments, announcements, or cleanup work.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The example response provides date-to-tone guidance that users may rely on operationally, but it appears inconsistent with the skill’s own calendar and sprint sequencing. In a productivity/planning skill, incorrect scheduling logic can mislead users about what actions to take on a given day, undermining trust and causing workflow errors, even though it is not a classic code-execution security issue.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: This example contains stronger contradictions about sprint boundaries and start dates, which can directly cause users to plan work on the wrong cycle and miss intended goal-setting or release phases. Because the skill is explicitly instructional and date-driven, inconsistent examples are especially dangerous: users may follow the example instead of the table, producing systematic planning errors.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.