Work Productivity Humanizer Remove Workflow Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 7:38 AM UTC
• Version: 0.20260729.110214

Overview

This is a documentation-only workflow helper with overbroad activation wording, but it does not request sensitive access, persistence, commands, or hidden behavior.

Before installing, be aware that this skill may trigger too often because its keywords are generic. It appears safe as a documentation-only helper, but maintainers should narrow the trigger wording or disable implicit invocation to avoid it taking over unrelated writing, editing, or bug-fix requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger examples are broad, generic phrases that can match many ordinary user requests unrelated to this skill’s intended scope. This increases the chance of accidental invocation or over-selection, which can cause the agent to apply the wrong workflow, mishandle user intent, or bypass more appropriate skills and safeguards.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad and map to common user language such as 'help me' and 'I need a practical workflow', which can cause this skill to activate for unrelated everyday requests. In an agent ecosystem, overbroad activation can route users into the wrong workflow, leading to unintended handling of prompts and increasing the chance of misuse or policy bypass through accidental invocation.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger keywords are extremely broad and include common terms like 'writing', 'text', 'editing', 'reviewing', and 'bug fix', which can cause the skill to activate for many unrelated requests. This creates unsafe over-selection risk: the agent may route ordinary user tasks into a specialized workflow that is not actually relevant, reducing reliability and potentially causing unintended behavior or policy bypass through mis-scoping.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description says to use the skill whenever a user asks for broad categories such as 'work-productivity' or needs almost any practical workflow, checklist, analysis, or implementation support for the requirement. This lacks meaningful boundaries, so the skill can be invoked outside its intended domain and crowd out more appropriate skills or safeguards.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The example trigger sentences are generic and repetitive, and they do not distinguish this skill from many other workflow-assistance requests. Ambiguous examples train selection systems and users toward overbroad invocation, increasing accidental activation and lowering trust in routing accuracy.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger keywords include very common terms such as "remove," "writing," "text," "editing," "reviewing," and "bug fix," which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance that this skill intercepts user requests outside its intended scope, leading to incorrect routing, prompt interference, or accidental application of workflow guidance where it does not belong.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description says the skill should be used when users mention broad categories like work-productivity, humanizer, remove, signs, or generated, or when they need practical workflow support for the requirement, but it does not clearly define exclusion criteria or precise activation boundaries. This ambiguity makes accidental triggering more likely and can cause the skill to be invoked for loosely related requests, reducing reliability and potentially overriding more appropriate skills.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation while advertising a very broad description and default prompt tied to generic terms like 'work-productivity' and 'practical workflow'. This can cause the skill to be auto-selected for unrelated user requests, expanding its reach beyond intended use and increasing the chance of prompt injection, unexpected behavior, or unsafe workflow interference.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger sentence is so broad and generic that it can match ordinary user requests far outside the intended scope of this skill. That creates unintended auto-activation risk, causing the agent to invoke this skill in unrelated contexts and potentially override more appropriate workflows or inject irrelevant instructions into user interactions.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: This activation text lacks clear boundaries and reads like a general-purpose request pattern, making accidental or excessive routing likely. In an agent system, ambiguous triggers can be exploited or simply misfire often, leading to prompt hijacking-by-routing, confusion, or misuse of a skill outside its validated domain.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.