Security audit

Work Productivity Agent Browser Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with overly broad activation wording but no executable code, persistence, credential handling, or hidden data movement.

Installers should understand that this skill may activate on broad browser or automation phrasing because implicit invocation is enabled. Review and narrow the trigger text if precise routing matters, but the inspected package does not contain executable code, credential access, persistence, or hidden network behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad enough to match ordinary user language unrelated to this specific skill, which can cause unintended skill activation and prompt-scope confusion. In an agent/browser automation context, accidental invocation is more dangerous because the skill may steer the agent into higher-risk operational workflows such as automation, debugging, or browser-driven actions without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description instructs use for a wide range of intents such as work-productivity, browser, headless, automation, artifacts, checklists, analysis, and implementation support without clear boundaries. This ambiguity can cause over-invocation and privilege the skill in contexts where a more specialized or safer skill should handle the task, degrading reliability and potentially expanding exposure to risky automation requests.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger keywords are very broad and include generic terms like "browser," "automation," and "cli," which can cause the skill to activate for many unrelated requests. In an agent system, this increases the chance of incorrect skill routing, unintended application of the workflow, and unsafe or confusing outputs when the skill is used outside its intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence begins with an extremely broad everyday phrase ('Help me ...'), which can cause the skill to activate for many unrelated user requests. In an agent environment, over-broad activation can route sensitive or irrelevant tasks into this skill unexpectedly, increasing the chance of unintended browser-automation guidance, prompt-scope confusion, or unsafe task handling.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This trigger sentence is ambiguous and does not define a precise activation scope, so the skill may be selected for vague requests that only partially resemble the intended use case. Because the skill covers browser and automation workflows, ambiguous invocation can expand operational scope and lead to misapplication in contexts involving external systems, credentials, or automated actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This README is presented entirely in Chinese, including usage instructions and trigger documentation, without stating that language is optional or offering an alternative within the file. That can constitute a language/locale policy issue if users are not given a choice or informed of available language options.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are extremely broad and include generic terms like browser, automation, and practical workflow, which can cause the skill to activate outside its intended scope. In an agent ecosystem, ambiguous invocation can route unrelated user requests into this skill, leading to unsafe automation guidance, incorrect tool selection, or unintended execution paths.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example trigger sentences are malformed, truncated, and do not provide clear activation patterns, which makes routing behavior harder to validate and easier to misfire. Poor examples can reinforce ambiguous invocation logic and lead operators or upstream planners to apply the skill inconsistently.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description defines activation using broad categories like work-productivity, browser, headless, and automation, which are common across many unrelated tasks. In systems that use descriptions for routing or selection, this increases the chance that the skill is invoked inappropriately, reducing reliability and potentially overriding more suitable specialized skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list is very broad, including generic terms like 'browser', 'automation', 'cli', and 'bug fix' that commonly appear in unrelated user requests. This can cause accidental invocation of the skill outside its intended scope, leading to misrouting, inappropriate guidance, or unnecessary exposure of skill behavior in contexts where a more specific skill should respond.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default prompt contains the broad trigger phrase 'help me' and only loosely constrains the task scope, which increases the chance of implicit or accidental invocation for unrelated user requests. Because implicit invocation is enabled, this can cause the skill to activate outside its intended browser-workflow context, potentially exposing users to unintended automation behavior or confusing task routing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: Natural-language policy checks apply to all file types. Listing language-specific instruction files without stating how language is selected may imply a fixed locale behavior rather than an explicit user choice, which can conflict with language/locale choice expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.