Product Validation Planner

• Outcome: Pass
• Latest audit: Jun 14, 2026 at 8:44 AM UTC
• Version:
  0.1.0

Overview

This is a text-only planning skill for product-validation help; its activation wording is too broad, but the artifacts do not show malicious behavior or sensitive access.

Safe to install if you want a simple product-validation planning helper, but expect possible accidental activation on generic product or ask-related prompts. The publisher should narrow the trigger keywords and consider disabling implicit invocation until the scope is clearer.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases and keywords are broad, repetitive, and weakly scoped (for example, generic terms like 'ask', 'product', 'high', and 'quality'). This can cause the skill to activate in unrelated contexts, leading to unintended instruction injection into conversations and increasing the chance that a user is steered into the wrong workflow.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger keywords and phrases are overly generic, including terms like "ask," "product," and "ready," which can cause the skill to activate in many unrelated conversations. In an agent setting, ambiguous activation can route user requests to the wrong workflow, causing unintended instruction execution, context confusion, or reduced reliability of downstream actions.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list includes extremely generic terms such as 'ask', 'product', 'very', 'high', 'quality', and 'ready', which are common in unrelated conversations. This can cause the skill to activate in contexts far outside its intended scope, leading to misrouting, inappropriate skill selection, and increased exposure to prompt/context interference from unrelated tasks.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description says to use the skill when a user asks for broad categories like 'creative-and-content', 'ask', 'product', or practical support, but it does not clearly define boundaries or exclusion criteria. That ambiguity makes over-triggering likely and can cause this skill to intercept requests better handled by other skills, reducing reliability and potentially introducing unsafe or irrelevant workflow steps into unrelated conversations.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger keywords include highly generic terms such as "ask", "product", "very", "high", "quality", and "ready", which can match many unrelated user requests. This creates an overbroad activation surface where the skill may be invoked outside its intended scope, causing inappropriate routing, context hijacking, or interference with more relevant skills.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description says the skill should be used when users ask for broad categories like creative-and-content, ask-hn, ask, product, or practical workflow/checklist/analysis support, but it does not define clear boundaries for when this skill should or should not apply. Such ambiguity can cause the orchestrator or agent to select this skill for many generic productivity or product-related prompts, reducing predictability and enabling unintended behavior overlap.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The example trigger phrases are extremely general and do not constrain invocation to a well-defined scenario. Because examples often shape matching behavior or operator expectations, these broad phrases reinforce accidental triggering and make the skill easier to invoke in unrelated contexts.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill uses vague, expansive phrasing such as "Helps with Help for a Product" and a broad default prompt, which can cause the agent to invoke this skill for loosely related requests. Overbroad auto-invocation increases the chance of unintended routing, prompt-scope confusion, and misuse of the skill outside its intended domain, especially with implicit invocation enabled.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases and keywords are broad, generic, and partially malformed (for example, 'ask', 'product', 'very', and 'Help me Help for a Product'), which can cause the skill to activate for unrelated user requests. Overbroad activation increases the chance of misrouting prompts, unintended invocation, and prompt-surface expansion, which is a real security and reliability issue in agentic systems even if it does not directly execute code.

VirusTotal

64/64 vendors flagged this skill as clean.