Work Productivity Proactive Agent Workflow Helper

• Outcome: Pass
• Latest audit: Jul 24, 2026 · 6:23 PM UTC
• Version: 0.1.0

Overview

This skill is a low-impact workflow helper with overly broad activation wording but no evidence of hidden code, data access, persistence, or unsafe automation.

Before installing, note that the skill may be selected for generic productivity or bug-fix requests because its trigger wording is broad. It appears safe as a documentation/workflow helper, but maintainers should narrow invocation terms if they want more predictable routing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger sentences are broad, repetitive, and semantically vague, which can cause the skill to activate in contexts that only loosely match the intended use case. In an agent ecosystem, overbroad activation increases the chance of unintended invocation, prompt collisions, and unsafe workflow execution on unrelated user requests.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger keywords and example invocations are extremely broad, including generic terms like 'task', 'transform', 'needs', and 'bug fix'. This can cause the skill to activate on ordinary user requests well outside its intended scope, leading to unintended prompt injection of the skill’s workflow, interference with other skills, and user confusion about why this skill was selected.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list includes very broad everyday terms such as "task," "needs," and "partners," which can cause the skill to activate in many unrelated conversations. Overbroad activation increases the chance of prompt-routing mistakes, causing this skill to intercept requests outside its intended scope and potentially influence workflows or outputs unexpectedly.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The manifest description says to use the skill when a user asks for broad concepts like "practical workflow," "artifact," "checklist," "analysis," or "implementation support," which are common across many benign requests. This ambiguity can cause over-selection of the skill, leading to inappropriate invocation and expanding the skill’s effective influence beyond the validated requirement.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list includes broad everyday terms such as "task", "needs", and "partners", which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance the agent applies this workflow out of context, producing irrelevant guidance, interfering with other skills, or steering user interactions unexpectedly.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description says to use it for broad categories like work-productivity, proactive, transform, and task, but does not define clear boundaries for inclusion or exclusion. This ambiguity can lead to accidental invocation on loosely related requests, which may override more appropriate skills or cause the agent to take action under weak intent matching.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The default prompt and short description use broad, vague language such as 'help me' and multiple generic workflow terms without defining clear invocation boundaries. Combined with allow_implicit_invocation: true, this can cause the platform to trigger the skill in situations the user did not explicitly intend, increasing the chance of inappropriate activation, prompt/context leakage into the skill, or workflow confusion.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger sentence is so broad and generic that it can cause the skill to activate for ordinary user requests that are not actually about this requirement. Over-broad invocation increases the chance of misrouting tasks, unexpected agent behavior, and accidental application of workflow logic in unrelated contexts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation guidance uses broad request forms like 'Help me' and 'I need a practical workflow' without clear scoping constraints, which makes the skill eligible for many unrelated prompts. In an agent environment, ambiguous routing can lead to incorrect tool/skill selection, reduced reliability, and potentially unsafe automation being applied outside its intended domain.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.