Security audit

Work Productivity Agent Browser Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with broad activation wording but no hidden code, persistence, credential handling, or destructive behavior.

Installers should be aware that this skill may be selected for broad browser or automation requests because implicit invocation is enabled and the trigger terms are generic. Review its output before acting on any generated automation plan, but there is no evidence of hidden execution, credential use, persistence, or destructive behavior in the package.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description is scoped to extremely broad terms like work-productivity, browser, automation, and implementation support, which can match many ordinary user requests unrelated to the intended niche. This overbroad routing can cause the skill to activate in inappropriate contexts, leading agents to apply browser-automation workflows or assumptions where they are not needed, increasing the chance of unsafe actions, poor task isolation, or policy bypass through unintended delegation.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The trigger keywords include vague high-frequency terms such as browser, automation, cli, optimized, and bug fix without qualifiers, making accidental or excessive activation very likely. In a skill that influences agent workflow selection, this can hijack unrelated requests into this skill's logic and broaden the operational surface for browser or headless automation guidance beyond the user's actual intent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says to use the skill whenever a user asks for broad categories like work-productivity, browser, headless, or automation, which are ambiguous and span many unrelated tasks. Overbroad activation criteria increase unintended invocation risk and may route users into a workflow that was not designed for their actual request.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keyword list includes very common terms such as "browser", "automation", and "cli", which are likely to appear in many unrelated user requests. This can cause the skill to activate unintentionally, leading to misrouting, prompt-surface expansion, and a higher chance that the skill influences tasks outside its intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentences are extremely broad and partially generic, making it easy for ordinary user requests about workflows, browser use, or productivity to invoke this skill unintentionally. In an agent ecosystem, overbroad activation can cause misrouting, unexpected execution paths, and increased exposure to any unsafe behavior or assumptions embedded in the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad enough to match ordinary user requests such as 'Help me' or 'I need a practical workflow,' which can cause unintended activation of this skill outside its intended scope. In an automation/browser workflow context, accidental invocation is more dangerous because the skill may steer the agent into higher-risk actions like browser automation, setup changes, or workflow execution without the user explicitly selecting that specialized behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad, generic, and partially templated from the demand statement, which increases the likelihood that the skill will be invoked unintentionally for loosely related requests involving browsers, automation, or productivity. In an agent environment, accidental invocation can route user tasks into the wrong workflow, causing inappropriate automation behavior, confusion, or unsafe execution paths if downstream steps assume stronger user intent than was actually expressed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example triggers use generic everyday phrasing like "Help me" and "I need a practical workflow", which can teach invocation systems or authors to match on weak signals rather than task-specific intent. While not directly exploitable code, this broadens activation patterns and increases accidental skill selection.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default prompt is framed as a broad catch-all invocation for generic work-productivity and browser-style workflow help, without meaningful constraints on when the skill should activate or what scope it should operate within. In combination with implicit invocation, this increases the chance the skill is triggered in unrelated contexts, causing prompt-scope creep, unintended delegation, or misuse of browser/headless automation capabilities.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The file describes language-specific skill files as fixed outputs, but does not state that the user can choose their preferred language or that language selection is optional. This can conflict with locale-choice policy when a skill appears to impose language behavior without explicit user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: In the Chinese-language README, the usage section presents trigger phrases only in English, which can impose a language expectation without opt-in or explanation. This may conflict with language/locale policy expectations because users are not given a Chinese alternative or a documented reason for the English-only phrasing.
Content: No source excerpt is available for this finding.