Security audit

Work Productivity Gog Google Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with broad activation language, but it does not include executable code, credential access, persistence, or hidden destructive behavior.

Install this only if you want a generic Gog/Google Workspace workflow helper. Because its implicit invocation and keywords are broad, users or maintainers should narrow triggers if possible and avoid sharing unnecessary private Gmail, Calendar, Drive, or Contacts data unless the specific task requires it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description is scoped so broadly that it can match many ordinary productivity, Google Workspace, CLI, or workflow-related requests, causing the skill to activate outside its intended niche. Overbroad routing increases the chance that this skill intercepts unrelated tasks, overrides more appropriate safeguards or domain-specific skills, and produces unintended actions or guidance in sensitive work contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords are highly ambiguous and include common terms such as 'google', 'workspace', 'cli', 'gmail', 'calendar', and 'bug fix', which appear in many benign requests unrelated to this skill's stated requirement. This makes accidental invocation likely and can lead to prompt hijacking of user workflows, poor task routing, and unexpected handling of potentially sensitive productivity data.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description defines activation conditions in an overly expansive way, covering generic requests for workflows, artifacts, checklists, analysis, or implementation support across broad domains. This ambiguity makes it unclear when this skill should be chosen over others, increasing the risk of accidental invocation and unreliable or unsafe task routing.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very broad, high-frequency terms such as "google", "workspace", and "cli", which can cause the skill to activate for many unrelated requests. Over-broad routing increases the chance of incorrect skill selection, causing mis-scoped assistance, policy bypass through unintended tool paths, or interference with more appropriate specialized skills.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger sentences are broad enough to match ordinary user requests about productivity or practical workflows without clearly scoping when this skill should activate. That can cause incorrect routing or over-invocation of the skill, which is dangerous in agent systems because the wrong workflow may handle unrelated requests and produce misleading actions or artifacts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrases are broad and generic enough that the skill could activate in contexts the user did not clearly intend, especially around common terms like Google, workspace, CLI, or bug fix. In an agent ecosystem, over-broad activation can cause the wrong skill to handle sensitive productivity workflows, leading to confused delegation, unintended access patterns, or unsafe task execution assumptions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad and generic enough to match ordinary productivity requests, which can cause the skill to activate outside its intended scope. In an agent ecosystem, over-broad routing increases the chance of unintended data handling, confusing task selection, and accidental invocation in contexts involving Gmail, Calendar, Drive, or other sensitive workspace workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default prompt uses very broad trigger language like 'help me' and a wide topic cluster, which can cause the skill to activate in many ordinary conversations outside a narrowly intended scope. In combination with agent routing, this increases the chance of unintended invocation, context hijacking, or the skill influencing tasks the user did not explicitly mean to delegate to it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Enabling implicit invocation without specific activation criteria or exclusions allows the platform to auto-select this skill based on vague overlap with common workplace terms like productivity, workflow, Google, or CLI. Because the skill is broadly described and framed around practical support, this can lead to accidental invocation in unrelated or sensitive tasks, expanding its influence beyond the user's clear consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: Natural-language policy review applies to all file types. These lines declare English and Chinese instruction files, but the README does not state that the user can choose their preferred language, which may imply a locale/language constraint without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This file is presented as a Chinese-language README, but important instructional content such as the requirement description and workflow explanation is written in English. That creates a language inconsistency that can force users into a language they did not choose, which is a natural-language policy concern.
Content: No source excerpt is available for this finding.