Error Message Improver

• Outcome: Pass
• Latest audit: Jun 14, 2026 at 8:45 AM UTC
• Version:
  0.1.0

Overview

This is a text-only helper for improving error messages, with overly broad activation wording but no evidence of unsafe access or behavior.

Safe to install if you want a lightweight helper for rewriting or planning clearer error messages, but expect possible accidental activation on generic support or debugging prompts. The publisher should narrow triggers to explicit error-message tasks and consider disabling implicit invocation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger sentences are broad enough to activate on generic requests about productivity, debugging, support, or workflows, which can cause the skill to be invoked outside its narrowly intended scope. In an agent setting, ambiguous activation boundaries increase the chance of misrouting user requests, overriding more appropriate skills, or applying the skill to contexts where its guidance is incomplete or unsafe.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough to match common troubleshooting and productivity requests, which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance of prompt or workflow hijacking at the orchestration layer, and can also crowd out more appropriate skills, leading to unsafe or misleading handling of user requests.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description uses very broad activation terms such as work-productivity, debugging, user feedback, support, and implementation support, which can cause the skill to be invoked for many unrelated requests. Over-broad routing increases the chance this skill intercepts tasks outside its intended scope, leading to inappropriate instructions, prompt-shadowing of more suitable skills, or accidental disclosure of context to an unnecessary skill.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger keywords are common terms used across a wide range of normal developer and support conversations, so they provide weak discrimination for skill activation. This makes unintended invocation likely, which can degrade agent behavior and create a larger attack surface for prompt-routing manipulation by embedding generic support or debugging language in a request.

Vague Triggers

Low

• Confidence: 88% confidence
• Finding: The example triggers are phrased as broad everyday requests and directly encourage invocation for a wide class of situations without meaningful constraints. While less severe than the description and keyword issues, these examples train routing behavior toward over-selection and can make accidental or adversarial triggering easier.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger keywords and example invocations are very broad, covering common terms like debugging, support, and troubleshooting that appear in many unrelated requests. This can cause unintended skill activation, which may steer the agent into an irrelevant workflow, reduce response quality, and create opportunities for prompt-surface expansion where skill instructions override more appropriate handling.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill enables implicit invocation but does not define a narrowly bounded trigger, so it may be auto-selected for a wide range of ordinary support or productivity requests. That can cause unintended routing, prompt-scope creep, and surprising execution of the skill in contexts the user did not explicitly request.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The default prompt uses broad activation language such as work-productivity, debugging, support, feedback, and implementation support, which overlaps heavily with common user requests. This increases the chance the orchestrator invokes the skill inappropriately, exposing users to irrelevant guidance and expanding the skill's effective authority beyond its stated function of improving error messages.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger sentence is broad enough to match common user requests such as 'Help me...' followed by a generic productivity need, which can cause the skill to activate outside its intended scope. In an agent system, overly broad activation increases the chance of prompt hijacking or unintended routing, especially because this skill is framed as a general workflow/helper capability rather than a narrowly bounded function.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: This trigger phrase is ambiguous and lacks clear boundaries on when the skill should engage, making it susceptible to accidental invocation from unrelated requests. Ambiguous routing conditions can expose the system to misclassification and unintended execution paths, which is a security concern when skills may alter outputs, workflows, or decision support without user intent.

VirusTotal

63/63 vendors flagged this skill as clean.