Work Productivity Nano Pdf Workflow Helper

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 5:52 AM UTC
• Version: 0.20260702.35207

Overview

This is a text-only workflow helper with overly broad activation wording, but it does not install code, request credentials, persist, or perform hidden file or network actions.

Install only if you want a general Nano PDF-style workflow helper. Expect possible over-activation on generic PDF or editing requests; prefer explicit invocation by skill name and review any suggested file or document changes before applying them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger phrases are broad natural-language prompts that can activate on ordinary user requests about PDFs, editing, or workflow help without clear boundaries. In an agent ecosystem, ambiguous activation increases the chance the skill runs unexpectedly, causing unintended document-related actions or injecting this skill into contexts where the user did not explicitly request it.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The README presents PDF editing and workflow assistance without warning that documents may be modified, transformed, or overwritten during use. Missing safety guidance can lead users or orchestrating agents to treat the skill as read-only, increasing the risk of accidental document alteration or loss of important work product.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger phrases are extremely generic and include common terms such as 'pdf', 'edit', 'natural', and 'language', which can cause the skill to activate for many unrelated user requests. In an agent ecosystem, overly broad activation increases the chance of unintended routing, prompt interference, or accidental execution of workflow logic in contexts the user did not intend.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The skill description includes very broad trigger terms such as "work-productivity," "nano," "pdf," and "edit," which are common in many unrelated user requests. This can cause unintended activation and routing of conversations into this skill when the user did not intend it, increasing the chance of inappropriate instructions, confusion, or interference with more suitable skills.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The keyword trigger list contains vague, high-frequency words including "nano," "pdf," "edit," "natural," "language," and "instructions" without contextual constraints. Because these words appear in many benign conversations, the skill may over-trigger broadly, causing prompt-routing errors and expanding the skill's influence beyond its intended domain.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The example trigger sentences are vague and repetitive, and they do not show clear boundaries for when the skill should or should not activate. Ambiguous examples reinforce overbroad matching behavior and make it harder for maintainers or routing systems to distinguish legitimate invocations from incidental mention of common terms.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger list includes very common terms such as 'nano', 'pdf', 'edit', 'natural', 'language', and 'instructions', which are likely to appear in many unrelated user requests. This can cause unintended skill activation, leading the agent to apply the wrong workflow, override more appropriate skills, or expose users to irrelevant automation behavior.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The description says to use the skill when users ask for broad categories like work-productivity, nano, pdf, edit, or any practical workflow/artifact/checklist/analysis support for the requirement. This activation condition is overly ambiguous and can match a wide range of unrelated tasks, increasing the chance of accidental routing and unsafe or incorrect agent behavior.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The default prompt invokes the skill with a very broad trigger phrase tied to generic terms like work-productivity, nano, and pdf, while the policy also permits implicit invocation. This increases the chance the skill is auto-selected in unrelated contexts, which can cause unintended prompt injection exposure, workflow interference, or execution of the skill when the user did not clearly request it.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger sentence is effectively a broad natural-language phrase rather than a narrowly scoped activation condition, so the skill may be invoked for generic requests that merely resemble the requirement text. Overbroad triggers increase the chance of unintended activation, causing context confusion, incorrect tool selection, or hijacking of unrelated user tasks into this workflow.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The invocation guidance uses a wide request pattern ('I need a practical workflow for ...') that can match many ordinary productivity requests without sufficient boundaries. In an agent environment, this can lead to accidental routing, skill overreach, and reduced trustworthiness because the skill may activate outside its intended PDF/workflow niche.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.