Security audit

Work Productivity Pollyreach Gives Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with no code execution or persistence, but its activation wording is too broad and should be tightened before users rely on implicit invocation.

Install only if you are comfortable with a broad workflow-helper skill that may be invoked accidentally by generic terms. Prefer explicit invocation by skill name, and the publisher should narrow triggers to PollyReach/workflow-specific phrases and improve the zh-CN localization.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger keywords and example invocations are broad, generic, and include ordinary terms like "every," "phone," "number," "ability," and "things," which can cause the skill to activate for unrelated user requests. In an agent ecosystem, this creates prompt-routing ambiguity and can lead to unintended execution of the skill, exposing users to incorrect workflows or bypassing more appropriate skills.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description says to use the skill when a user asks for broad terms like 'work-productivity' or 'needs a practical workflow, artifact, checklist, analysis, or implementation support,' which matches a very large share of benign requests. This overbroad activation condition increases the chance the skill will be selected outside its intended domain, causing misrouting and potentially exposing unrelated user context to an ill-fitting workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list contains highly generic terms such as 'every', 'phone', 'number', 'ability', 'things', and 'done', which are common in ordinary conversation and unrelated to a narrowly scoped PollyReach workflow. In an agentic environment, this can cause accidental invocation of the skill in unrelated contexts, leading to inappropriate tool selection, context bleed, and unreliable or unsafe downstream actions.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger keyword list includes very generic terms such as "every", "phone", "number", "ability", "things", and "done", which can cause the skill to activate on unrelated user requests. Over-broad activation increases the chance of accidental routing, irrelevant instructions being injected into benign conversations, and unintended execution of workflow logic outside its intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger examples include very broad, everyday terms and generic phrasing that can match unrelated user requests, causing the skill to activate outside its intended scope. In an agent ecosystem, this can route conversations into the wrong workflow, create misleading outputs, and increase the chance that a lower-safety or irrelevant skill handles sensitive tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger set is broad, generic, and partially unrelated to the stated capability, including common words like 'every', 'phone', 'number', 'ability', and 'things'. This increases the chance of accidental invocation in unrelated conversations, causing the wrong skill to activate, which can misroute user intent, expose irrelevant instructions, or interfere with safer/more appropriate skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: In a file presented as simplified-Chinese documentation, core instructional content is written in English, which effectively imposes a language choice without user opt-in. This can violate language/locale policy expectations because the file does not explain the mixed-language behavior or offer an alternative preference mechanism.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Key usage guidance and trigger examples in a zh-CN document remain in English, which may force users into a language they did not select. Because the file gives no rationale, regional limitation, or opt-in language choice, this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example trigger phrases are effectively templates around broad natural-language requests and do not demonstrate safe, specific activation boundaries. Because examples often shape routing behavior and author expectations, these generic phrases reinforce accidental activation on ordinary help requests rather than only on intended PollyReach-related tasks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: 该文件整体以 zh-CN 形式提供，且正文未说明用户可选择其他语言，也未写明仅在用户明确要求中文时才适用。根据语言/区域策略，若技能默认强制特定语言而无用户选择或合理限定，属于自然语言策略问题。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to use the skill when users mention broad terms or need "practical workflow, artifact, checklist, analysis, or implementation support" for the requirement, but it does not clearly bound what requests qualify. This ambiguity can cause over-triggering and misapplication of the skill in contexts unrelated to the intended PollyReach-inspired workflow task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The default prompt is written as a generic invocation phrase and includes broad natural-language terms that can overlap with ordinary user requests. Combined with implicit invocation being enabled, this increases the chance the skill is triggered unintentionally, causing prompt/context injection into unrelated conversations and unexpected skill execution.
Content: No source excerpt is available for this finding.