Work Productivity Proactive Agent Workflow Helper

• Outcome: Pass
• Latest audit: Jul 24, 2026 · 5:48 PM UTC
• Version: 0.1.0

Overview

This is a documentation-only workflow helper with overly broad activation wording, but it does not show hidden behavior, data access, persistence, or destructive actions.

Before installing, understand that this skill may be selected for more general productivity or task-planning requests than intended because its trigger wording is broad and implicit invocation is enabled. Prefer explicit invocation for proactive-agent workflow help, and consider narrowing triggers if you maintain the package.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad, generic, and partially templated around common workflow terms like 'help me', 'practical workflow', 'task', and 'proactive', which increases the chance the skill activates for unrelated user requests. In an agent ecosystem, overbroad activation can route sensitive or irrelevant tasks into the wrong skill, causing unintended behavior, reduced reliability, and possible unsafe handling of requests outside the skill’s intended scope.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger phrases and keywords are broad enough to match common, everyday requests such as 'task', 'transform', or 'help me', which can cause the skill to activate outside its intended scope. In an agent ecosystem, this can lead to misrouting, unintended invocation, and increased exposure to downstream prompt or workflow abuse because the skill may engage on loosely related prompts without clear user intent.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list is excessively broad and includes generic terms like 'task', 'transform', 'needs', and 'proactive' that commonly appear in ordinary conversations. This can cause the skill to activate outside its intended scope, leading to unintended routing, user confusion, or inappropriate application of the skill in unrelated contexts.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The manifest description says to use the skill when a user asks for broad concepts like 'work-productivity', 'proactive', 'transform', 'task', or any practical workflow or checklist support. Such ambiguous matching criteria greatly expand the activation surface, increasing the chance the skill is selected for unrelated requests and interfering with more appropriate skills or system behavior.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger list is overly broad and includes common terms such as 'task', 'needs', and 'bug fix', which can cause this skill to activate in many unrelated conversations. That creates unintended routing and prompt-scope confusion, making it easier for the skill to interfere with other workflows or be invoked when the user did not intend to use it.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation description is broad and vague, covering general requests for 'practical workflow, artifact, checklist, analysis, or implementation support' around multiple generic concepts. This ambiguity increases the chance of accidental invocation or misapplication, which can lead to incorrect task routing, unexpected behavior, and reduced reliability of the agent system.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The display name, short description, and default prompt are extremely broad and generic, covering terms like productivity, proactive, transform, task, checklist, analysis, and implementation support. This can cause the platform to match and invoke the skill for many unrelated requests, leading to unintended activation, misrouting of user tasks, and expansion of the skill’s effective authority beyond its intended scope.

Vague Triggers

High

• Confidence: 99% confidence
• Finding: Enabling implicit invocation without tight trigger constraints allows this broadly described skill to be auto-selected without explicit user intent. In context, that is especially risky because the skill markets itself as a catch-all helper for workflows, bugs, safety, reliability, artifacts, and implementation support, making accidental invocation much more likely.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger phrases are broad enough to match ordinary user language such as 'help me' and 'I need a practical workflow,' which can cause the skill to activate in many unrelated contexts. In an agent environment, this can lead to incorrect routing, unexpected workflow execution, and reduced trust because a generic productivity skill may intercept requests not actually intended for it.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.