Work Productivity Ontology Typed Workflow Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 7:43 AM UTC
• Version: 0.20260729.110214

Overview

This is a documentation-only workflow helper with no executable code or privileged behavior, but its automatic activation wording is overly broad.

Install only if you want a general ontology-style workflow planning helper. Be aware it may be invoked too often because its triggers include generic terms like workflow, knowledge, graph, memory, creating, and bug fix.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad, generic, and include common help-seeking language, which increases the chance the skill activates outside its intended scope. In an agent ecosystem, this can cause unintended invocation, misrouting of user requests, and execution of the wrong workflow, especially for ordinary productivity or bug-fix prompts that match these phrases.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad, generic, and match common help-seeking language, which can cause the skill to activate for ordinary requests outside its intended scope. In an agent ecosystem, this increases the chance of misrouting, unintended invocation, and over-application of the skill to unrelated user tasks, reducing reliability and potentially bypassing more appropriate safety or domain-specific handling.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill description is broad enough to match many ordinary requests for workflows, analysis, implementation help, or checklists, which can cause the skill to activate outside its intended niche. Over-broad routing increases the chance of mis-selection, instruction interference, and unintended delegation to a skill whose guidance may not fit the user’s actual task.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The keyword list includes generic terms such as "knowledge," "graph," "structured," "memory," "creating," and "bug fix," which appear in many unrelated conversations. This makes accidental or excessive triggering likely, potentially diverting unrelated tasks into this skill and creating prompt-routing instability across the broader agent system.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The example trigger phrases rely on highly generic lead-ins like "Help me" and "I need," which are common in normal user prompts and provide little discrimination for reliable activation. Even if intended as examples, they reinforce loose activation patterns that can cause false positives and unnecessary skill invocation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger keyword list includes very broad, common terms such as "typed", "knowledge", "graph", "creating", and "bug fix", which can match many unrelated user requests. This can cause unintended skill activation, leading the agent to inject irrelevant workflow guidance into contexts where it was not requested, reducing reliability and potentially interfering with safer or more appropriate skills.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description says the skill should be used for users asking about work-productivity, ontology, typed, knowledge, or graph, or whenever they need a practical workflow, artifact, checklist, analysis, or implementation support. That scope is so broad that it overlaps with many ordinary requests, making accidental invocation likely and increasing the chance of misrouting user tasks or overriding more suitable instructions.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The default prompt contains very broad, natural-language trigger terms like work-productivity, workflow, checklist, analysis, and implementation support that can match many ordinary user requests. This increases the chance of unintended skill activation, causing the agent to inject this skill's instructions or context into unrelated conversations and potentially alter behavior without clear user intent.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: Enabling implicit invocation without strict trigger constraints allows the platform to auto-select this skill based on loosely related requests. Combined with the broad productivity/ontology wording, this can cause frequent unintended invocation, prompt-surface expansion, and cross-context interference where the skill influences outputs in situations the user did not request.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger sentences are broad enough to match ordinary requests about workflows, bug fixes, hardening, or ontology-related help, which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance of prompt/skill routing hijack, unintended disclosure of internal skill behavior, or incorrect task handling when a more appropriate skill should have been selected.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.