Security audit

Work Productivity Agent Browser Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with broad activation wording but no hidden execution, credential access, persistence, or destructive behavior.

Before installing, consider narrowing or explicitly invoking this skill because generic browser or automation requests may trigger it. The inspected package does not show hidden code execution, data access, persistence, or destructive actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are very broad generic requests such as asking for 'a practical workflow' or help with common browser/automation tasks, which can cause the skill to activate for ordinary conversations unrelated to the intended use case. In an agent ecosystem, overbroad activation can route user requests into unintended workflows, increasing the chance of prompt hijacking, incorrect tool use, or confused-deputy behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence is overly broad and can cause the skill to activate on common, loosely related user phrasing rather than an explicit request for this capability. In an agent-routing context, that can misinvoke browser or automation-oriented behavior, leading to inappropriate handling of user requests, confusion, or expanded exposure of powerful workflow guidance where it was not intended.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation guidance does not meaningfully constrain scope and instead encourages activation for a wide set of generic productivity and browser-related requests. This makes accidental or excessive activation more likely, which can misapply the skill to unrelated contexts and increase the risk of unintended automation, misleading outputs, or policy bypass through overreach.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger sentence is extremely broad and can match ordinary user language about help, workflows, or browser automation, which increases the chance of unintended skill activation. In an agent environment, overbroad activation can route unrelated requests into this skill, causing inappropriate guidance, confused task execution, or unsafe browser-automation behavior outside the user's intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file references separate English and Chinese documentation variants, while this README itself is specifically in Simplified Chinese, but it does not state that language choice is optional or user-selectable. This can create a locale-policy concern because the document presents a fixed language context without explicit opt-in guidance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description uses expansive activation language such as "Use when a user asks for work-productivity, agent-browser, browser, headless, automation," without defining exclusion conditions or specificity thresholds. In a dispatcher or skill-routing system, this can cause over-selection of the skill for ordinary browser or automation tasks, reducing reliability and creating opportunities for unintended behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list is broad and includes generic terms like "browser," "automation," and "cli," which are common across many unrelated requests. This increases the chance of accidental invocation, causing the wrong skill to activate and potentially steering users into unintended workflows or exposing them to irrelevant automation guidance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description and trigger scope are broad enough that common terms like browser, automation, or work-productivity could cause the skill to activate outside its intended context. Over-broad activation can route unrelated user requests into this skill, leading to inappropriate guidance, reduced reliability, and possible unsafe handling if browser automation advice is applied where it was not requested.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The keyword list lacks constraints, disambiguation rules, and negative examples, so the activation surface is unclear and overly permissive. This increases the chance of accidental invocation on generic requests involving browser, automation, cli, or bug fix, which can create misrouting, prompt contamination, or unintended execution paths in agent systems.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The default prompt includes a very broad trigger phrase tied to common terms like work-productivity, browser, headless, automation, and practical workflow help, while implicit invocation is enabled. This can cause the skill to activate in loosely related contexts and inject its instructions unexpectedly, increasing the risk of prompt hijacking, unintended tool use, or user confusion about which behavior is in effect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: An ambiguous trigger sentence makes activation insufficiently specific, increasing the chance that the skill is selected for requests it cannot safely or accurately satisfy. In this skill's context, that is mainly a routing and reliability risk: users may receive browser/automation workflow guidance when they meant something else, degrading trust and potentially encouraging unnecessary automation steps.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: 文档主体以中文撰写，但 L11-L13 保留了较长英文说明，未声明输出语言应跟随用户偏好或提供语言选择。该文件名虽为 zh-CN，但自然语言说明未明确告知是否强制中文或支持按用户语言切换，存在语言/地区策略不清的问题。
Content: No source excerpt is available for this finding.