Security audit

Work Productivity Ontology Typed Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with imprecise activation wording but no evidence of hidden code, credential handling, persistence, or destructive behavior.

Before installing, understand that this skill may be invoked broadly because of generic trigger terms such as knowledge, graph, structured, memory, creating, and bug fix. It appears safe as a workflow helper, but users may want narrower invocation rules to avoid irrelevant activation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description uses very broad activation terms like 'work-productivity', 'knowledge', 'analysis', and 'implementation support', which can cause the skill to be invoked for many unrelated user requests. Over-broad routing increases the chance that this skill handles tasks outside its validated scope, leading to incorrect tool selection, unexpected behavior, and possible bypass of more appropriate specialized skills.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger keyword list contains highly ambiguous standalone terms such as 'typed', 'knowledge', 'graph', 'structured', 'memory', and 'creating'. These common words are likely to appear in unrelated conversations, making accidental or inappropriate invocation more likely and reducing confidence that the selected skill matches the user's actual intent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger sentence begins with a very broad phrase ('Help me') and then appends requirement text, which creates weak activation boundaries. In agent routing systems, this can cause the skill to fire on ordinary user requests that merely resemble the phrase, leading to misrouting, unintended invocation, and possible over-collection or mishandling of user tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger examples are broad, repetitive, and phrased in a way that could match loosely related user requests, increasing the chance the skill is invoked when the user did not intend it. In an agent ecosystem, unintended invocation can route tasks into the wrong workflow, causing inappropriate actions, confusing outputs, or bypass of more suitable safeguards in other skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad, natural-language requests that can easily match ordinary user speech, causing the skill to activate unintentionally. In an agent ecosystem, overbroad invocation can route unrelated tasks into this workflow, increasing the chance of incorrect handling, prompt collision, or unexpected access to downstream capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example trigger sentences are written in ordinary natural language and closely resemble generic user requests for help, which makes them poor discriminators for safe invocation. If used by an agentic router or copied as guidance, they can encourage matching on vague phrasing rather than on the skill's intended specialized scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation description says to use the skill whenever a user mentions broad categories like work-productivity, ontology, typed, knowledge, or graph, or when they need practical workflow or analysis support. This activation rule is overly expansive and may match a wide range of unrelated requests, increasing the chance of accidental selection and incorrect task handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes very generic terms such as "knowledge", "graph", "structured", "creating", and "bug fix", which are likely to appear in many unrelated user prompts. This can cause unintended activation of the skill, leading to prompt routing errors, irrelevant guidance, or overshadowing of more appropriate skills; in agent systems, misrouting can degrade safety if the wrong workflow handles sensitive tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest enables implicit invocation while describing the skill in broad, generic terms such as helping with workflow, checklist, analysis, or implementation support. This increases the chance the agent will auto-select the skill outside its narrowly intended scope, which can route unrelated user requests into a skill that may apply unsafe assumptions or expose unintended behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger sentence ('I need a practical workflow for ...') is still generic enough to overlap with many benign requests, especially because the remainder is long requirement prose rather than a precise activation rule. This increases the chance of accidental selection of the skill in contexts unrelated to the intended ontology-style workflow use case, reducing reliability and potentially exposing downstream processes to irrelevant or unsafe inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The natural-language documentation declares English and Chinese variants, but it does not state how the user's preferred language is selected or that language choice is optional. This can create a locale-policy concern if the skill defaults to a language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This zh-CN README contains substantial English instructional content and trigger phrases, but does not state whether users may interact in Chinese, English, or choose their preferred language. That can amount to an implicit language policy without user opt-in, especially in a locale-specific documentation file.
Content: No source excerpt is available for this finding.