Work Productivity Multi Search Workflow Helper

• Outcome: Pass
• Latest audit: Jul 24, 2026 · 6:14 PM UTC
• Version: 0.1.0

Overview

This is a low-risk workflow guidance skill, though its activation triggers are overly broad and could cause it to appear in unrelated requests.

Before installing, consider narrowing the trigger terms and disabling or tightening implicit invocation so ordinary requests about search, engines, bug fixes, or workflows do not accidentally activate this skill. The inspected content is otherwise a plain guidance skill without privileged runtime behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad, generic, and include normal conversational language that could cause accidental activation outside the intended use case. In an agent ecosystem, overly permissive triggers can route unrelated user requests into this skill, producing incorrect behavior, unintended tool use, or bypass of more appropriate safeguards.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger keywords and example phrases are extremely broad (e.g., generic terms like 'multi', 'search', 'engine', 'integration', 'bug fix'), making accidental invocation likely during ordinary conversations. In an agent skill ecosystem, overbroad triggers can cause the wrong skill to activate, inject irrelevant workflow behavior, or override more appropriate handling, which increases operational and safety risk.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger keywords include extremely generic terms like "multi," "search," "engine," "integration," and "bug fix," which can cause the skill to activate for many unrelated requests. Overbroad activation increases the chance that the wrong skill handles user input, leading to confused task routing, accidental disclosure of context to an irrelevant workflow, or unsafe automation being applied outside its intended scope.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The description says to use the skill when a user asks for broad categories like work-productivity, multi, search, or engine, without defining clear scope limits. This makes invocation criteria ambiguous and can cause the skill to capture unrelated conversations, reducing predictability and increasing the risk of inappropriate or over-privileged assistance.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example triggers are malformed, repetitive, and so broad that they fail to give reliable activation guidance. Poor examples encourage inconsistent routing behavior and make it easier for unrelated prompts to activate the skill accidentally, especially in systems that learn or derive trigger behavior from examples.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger list includes very generic terms such as 'multi', 'search', 'engine', 'integration', and 'global', which are likely to appear in many unrelated user prompts. This can cause the skill to activate unintentionally, leading to incorrect routing, over-broad invocation, and increased chance that the agent applies this workflow in contexts it was not designed for.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The description says the skill should be used when users mention broad terms like work-productivity, multi, search, or engine, but it does not clearly define boundaries for when invocation is appropriate. Ambiguous activation criteria increase the risk of accidental selection and misapplication of the skill, especially in multilingual or general productivity conversations.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The default prompt trigger phrase is overly broad and includes generic terms like 'help me' and common productivity/search wording, which can cause unintended implicit invocation during normal user conversations. Because implicit invocation is enabled, this increases the chance the skill activates when not specifically requested, potentially injecting its workflow or instructions into unrelated tasks and reducing user control.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger sentence is excessively broad and can match ordinary user phrasing unrelated to this skill’s intended scope. That can cause accidental skill activation, increasing the chance that the agent injects irrelevant workflow behavior into unrelated tasks and expands the attack surface for prompt-routing mistakes.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: This generic request pattern lacks clear scope boundaries, so it may capture a wide range of normal help requests that do not actually relate to the documented requirement. In an agent environment, overbroad routing can lead to inappropriate tool or skill selection, confusing outputs, and possible chaining into other risky behaviors when the wrong workflow is invoked.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.