Security audit

Work Productivity Agent Browser Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with overbroad activation wording, but no hidden code, credential access, persistence, or destructive behavior was found.

Before installing, be aware that this skill may trigger on ordinary browser, automation, CLI, or bug-fix requests because its activation language is broad and implicit invocation is enabled. It appears safe as a documentation/workflow helper, but maintainers should narrow the trigger phrases if precise routing matters.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad and map to common terms like 'browser', 'automation', and 'help me', which can cause the skill to activate in many unrelated conversations. In an agent environment, overbroad activation can route users into this workflow unexpectedly, leading to prompt hijacking of task selection, confusion, or inappropriate use of browser/headless automation guidance where it was not intended.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description includes very broad activation terms like 'browser', 'automation', and 'practical workflow' that can match many ordinary user requests unrelated to this specific skill. This can cause the skill to be invoked out of scope, leading to incorrect routing, over-broad assistance, or accidental exposure of users to browser automation guidance when they did not request it.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords include common terms such as 'browser', 'automation', 'cli', and 'bug fix' without qualifiers, making accidental activation likely across a wide range of unrelated conversations. In an agent environment, over-triggering is more dangerous because it can redirect execution paths, produce irrelevant operational guidance, or cause an automation-oriented skill to handle requests that should remain manual or be routed elsewhere.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentence begins with a very common phrase ('Help me ...'), which is likely to appear in many unrelated user requests. In a skill-routing system, this can cause unintended invocation of this skill, leading the agent to select browser-workflow guidance when the user did not explicitly ask for it, increasing the chance of misrouting and unsafe or irrelevant automation behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The invocation section does not meaningfully constrain when the skill should be selected; instead, it presents malformed example phrases that still map to broad user intents like productivity, browser, automation, and bug fixing. This weak scoping can cause overmatching during routing, especially because the skill targets powerful browser/headless workflow use cases where unintended activation may influence agent behavior beyond the user's actual request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger guidance includes generic phrases such as 'Help me' and 'I need a practical workflow,' which are common in normal user requests and can cause the skill to activate unintentionally. In an automation/browser-workflow context, accidental invocation can steer the agent into using this skill when the user did not intend it, increasing the chance of misapplied actions, confusing outputs, or unsafe browser automation guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This Chinese README contains core descriptive content in English, which can impose a language choice on users of the zh-CN variant instead of consistently serving the documented locale. There is no indication that users may choose their preferred language or that the mixed-language content is intentional and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example trigger sentences are malformed and truncated, so they do not provide reliable activation guidance or clear boundaries for use. This ambiguity increases misrouting risk because systems or maintainers may infer activation behavior from unclear examples, especially when combined with already broad keywords and descriptions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation criteria in the description are vague and say to use the skill whenever a user asks for broad categories like work-productivity, browser, or automation. Without clear boundaries for when not to trigger, the skill may be selected for many ambiguous requests, which weakens routing safety and can override better-matched skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger keywords are extremely broad (for example, browser, automation, cli, bug fix) and overlap with many ordinary user requests. This can cause the skill to activate unintentionally in unrelated contexts, increasing the chance of misrouting, confusing responses, or applying browser-automation guidance where it was not requested.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default prompt uses very broad, generic phrasing tied to common tasks such as workflow help, browser automation, checklists, analysis, and implementation support. This can cause the skill to be invoked for ordinary user requests beyond its intended scope, increasing the chance of prompt-context hijacking, overreach into unrelated tasks, or accidental exposure of the skill in conversations where it was not explicitly requested.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Enabling implicit invocation without clear trigger constraints allows the platform to auto-select this skill in response to loosely related prompts. In combination with the broad productivity/browser description, this raises the risk of unintended activation, unnecessary prompt injection surface area, and the skill influencing sessions where the user did not intend to use it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Although this trigger includes more context, it still starts with a broad phrase ('I need a practical workflow for ...') and embeds requirement text rather than a precise activation condition. That makes accidental matching plausible in normal conversation, which can cause the system to invoke this skill in situations where a different skill or no skill should be used.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: SQP-3 适用于所有文件类型。该技能文档主体以中文呈现，且文件名为 SKILL.zh-CN.md，但文中未说明这是可选语言版本，也未向用户提供语言选择或切换机制。若技能面向广泛用户群体，这种默认固定语言可能构成语言策略问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.