Work Productivity Ontology Typed Workflow Helper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:32 AM UTC
• Version: 0.20260729.110214

Overview

This is a low-privilege workflow helper with overly broad activation wording, but I found no hidden execution, persistence, credential access, or destructive behavior.

Before installing, consider that this skill may be invoked more often than intended because implicit invocation is enabled and the trigger terms are broad. It appears safe from a security standpoint, but the publisher should narrow triggers and improve the Chinese localization for clearer user control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description is broad enough to match many ordinary productivity, workflow, or implementation requests, which can cause the skill to activate outside its intended niche. Over-broad activation increases the chance that a less appropriate or less safe workflow is injected into unrelated conversations, creating misrouting, confusion, and possible policy bypass through unintended tool/skill selection.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The keyword list includes highly generic terms such as 'typed', 'knowledge', 'graph', 'structured', 'creating', and 'bug fix', which are common across many unrelated requests. Ambiguous trigger terms make accidental invocation likely and can route users into this skill when another skill or baseline handling would be safer or more accurate.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill enables implicit invocation while using a broad default prompt and generic trigger language around productivity, workflows, knowledge, and analysis. This can cause the platform to auto-select the skill in situations the user did not clearly intend, increasing the chance of unintended prompt injection exposure, incorrect task routing, or application of this skill to unrelated requests.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrase "Help me" is extremely broad and can match many unrelated user requests, causing the skill to activate outside its intended domain. Over-broad activation increases the chance of incorrect routing, unintended execution precedence, or misuse of the skill in contexts where its assumptions do not apply.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger examples are generic enough to match ordinary productivity and workflow requests, which can cause the skill to activate outside its intended scope. Over-broad activation increases the chance that users are routed into a specialized ontology workflow unexpectedly, leading to prompt hijacking of task routing, user confusion, or inappropriate handling of unrelated requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases are broad, generic request patterns such as asking for 'a practical workflow' or 'help me', which can overlap with ordinary user speech and cause the skill to activate unintentionally. In an agent ecosystem, over-broad activation can route unrelated tasks into this skill, increasing the chance of incorrect guidance, workflow confusion, or accidental execution in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description defines activation conditions using a very broad set of domains and output types, such as work-productivity, ontology, typed, knowledge, graph, or any request for workflow, artifact, checklist, analysis, or implementation support. This ambiguous scope makes the router likely to invoke the skill outside its intended context, creating prompt-routing risk and reducing reliability and safety boundaries between skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords include very broad, common terms such as "typed", "knowledge", "graph", "structured", and "creating", which can cause the skill to activate for many unrelated prompts. Over-broad activation can misroute user requests, override more appropriate skills, and increase the chance that adversarial or irrelevant content is processed under the wrong workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger sentence "I need a practical workflow for..." is still too general because many tasks could fit that wording without clearly indicating this specific skill should run. Ambiguous activation conditions can lead to accidental invocation, user confusion, and unsafe or low-quality outputs when the skill is applied beyond its designed scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file is presented as a Chinese-language README, but core descriptive content is written in English, which can impose a language choice on users without opt-in. The document does not indicate that users may choose their preferred language or locale for this skill’s instructions.

Content

No source excerpt is available for this finding.