Security audit

Work Productivity Ontology Typed Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-style workflow helper with overly broad activation wording, but it does not include code, credential access, persistence, or hidden actions.

Before installing, treat this as a low-risk workflow prompt. The main thing to watch is over-activation: if your platform auto-selects skills, narrow or disable implicit invocation so this helper only runs for explicit ontology-style workflow requests.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description includes very broad activation terms such as work-productivity, knowledge, graph, checklist, analysis, and implementation support, which can cause the skill to match many unrelated user requests. In an agent-routing environment, overbroad matching can hijack prompts away from better-scoped skills, increasing the chance of inappropriate behavior, incorrect outputs, or unsafe delegation.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger keyword list contains generic tokens like knowledge, graph, structured, memory, creating, and bug fix, which are common across many unrelated tasks. This makes accidental or excessive activation likely, especially in automated skill selection systems that rely on keyword overlap rather than deep semantic validation.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger examples include broad natural-language phrasing such as 'Help me' and 'I need a practical workflow', which are common in ordinary user requests and can cause the skill to activate outside its intended scope. In an agent ecosystem, unintended invocation can route unrelated tasks into this skill, producing incorrect behavior, confusing outputs, or unsafe automation chaining.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad, generic, and partially match ordinary user requests about help, workflows, or hardening, which can cause the skill to activate when the user did not explicitly intend to invoke it. In an agent ecosystem, unintended invocation can misroute tasks, override more appropriate skills, or expose the user to incorrect workflow guidance based on weak keyword matches.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough to match routine requests for help, practical workflows, or bug fixing, which can cause the skill to activate outside its intended scope. In an agent ecosystem, overbroad activation can misroute user tasks, increase unintended tool usage, and create opportunities for prompt-surface expansion where the skill influences unrelated requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example trigger phrases use ordinary language like help me and practical workflow, while embedding broad requirement text that does not clearly separate valid invocations from invalid ones. Ambiguous examples can train maintainers or routing systems to invoke the skill in situations outside its intended scope, leading to misrouting and unreliable behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: 技能描述把适用范围定义为用户提出 work-productivity, ontology, typed, knowledge, graph 或需要“实用流程、产物、检查清单、分析或实现支持”时使用，这些条件过于宽泛且边界不清。模糊的启用范围会导致该技能在大量一般性生产力、知识整理或实现类请求中被启用，从而扩大误路由和不恰当上下文覆盖的攻击面。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 触发关键词包含 typed、knowledge、graph、creating、bug fix 等高频且语义宽泛的日常词汇，容易在与本技能并不相关的对话中被误触发。误调用会把用户路由到错误工作流，导致无关指令被注入当前任务上下文，增加混淆、越权辅助或错误执行建议的风险。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The default prompt is broad and uses generic terms like "help me" and "workflow" that can match many ordinary user requests, increasing the chance this skill is invoked outside its intended scope. Because the skill is framed as broadly useful for productivity, ontology, checklists, analysis, and implementation support, accidental over-selection could route unrelated tasks through this skill and expose users to unintended behavior or lower-quality handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Enabling implicit invocation without tight activation constraints allows the platform to auto-select this skill based on loose semantic matches rather than explicit user intent. In this skill, the broad metadata and generic productivity framing make that especially risky, because the skill may be triggered for many unrelated requests and bypass meaningful user choice about which capability is being applied.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation examples do not clearly delimit when the skill should versus should not run, so matching systems may over-select it for vague requests involving productivity, workflows, or bug fixing. This ambiguity increases the chance of prompt-routing errors and accidental execution in contexts the skill was not designed to handle.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The evidence section includes multiple Chinese-language titles and links, but the document does not explain any language expectations or give users an explicit language/locale option. Because policy checks apply to natural-language content in all file types, this can be read as implicitly steering users toward a specific locale without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The README is localized in Chinese, but it explicitly states that SKILL.md is the English version and does not mention any user choice or language preference for operation. This can indicate a language/locale constraint without opt-in, which may conflict with language-choice policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: 该技能文件为 SKILL.zh-CN.md，全文内容以中文呈现，但没有任何自然语言说明表明这是用户自选语言、可切换语言，或仅适用于特定中文场景。按规则，这类固定语言/地区呈现若缺少用户选择或合理限制说明，可能构成语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.