Work Productivity Self Improving Workflow Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 6:51 AM UTC
• Version: 0.20260729.110214

Overview

This is a documentation-only workflow helper with overly broad activation wording, but no hidden execution, credential access, persistence, or destructive behavior.

Install only if you want a general workflow helper for self-improving or proactive agent work; be aware it may activate on broad productivity or bug-fix phrasing unless the platform’s routing is tightened or you invoke skills explicitly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrase is broad enough to match ordinary user language about wanting practical help or a workflow, which can cause the skill to activate outside its intended scope. In an agent ecosystem, over-broad activation can route unrelated requests into this skill, creating prompt-surface expansion and increasing the chance of inappropriate autonomous behavior or user confusion.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation guidance lacks precise constraints, so the skill may be selected for common productivity, bug-fix, or planning requests that were not meant for a self-improving proactive workflow helper. Because this skill is framed around proactive and self-improving behavior, ambiguous routing is somewhat more dangerous than for a passive informational skill, as it can expand autonomy and action scope unexpectedly.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are extremely broad, including generic terms like 'self', 'improving', and 'proactive', plus natural-language trigger examples that resemble ordinary user requests. This can cause unintended invocation on unrelated conversations, expanding the skill's reach beyond user intent and increasing the risk of prompt collision or accidental workflow execution.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger list includes extremely broad terms like "self," "improving," and "proactive," which are common in ordinary user requests and unrelated domains. This can cause unintended auto-invocation, expanding the skill's reach beyond its intended scope and potentially letting a self-improving workflow influence tasks where it was not explicitly requested.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The manifest description says to use the skill whenever a user asks for broad categories like work-productivity, self, improving, or practical support, making invocation criteria ambiguous and overinclusive. In an agent ecosystem, this increases the chance the skill is selected for unrelated tasks, which can lead to inappropriate guidance, unexpected autonomy, or interference with safer, more specific skills.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger keywords include extremely broad everyday terms such as "self", "improving", and "proactive", which can match many unrelated user requests. This can cause accidental invocation of the skill outside its intended scope, leading to inappropriate workflow steering, prompt/context pollution, and reduced reliability of agent behavior.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill description defines activation conditions too broadly, covering common concepts like work productivity and proactive improvement without clear boundaries. An overbroad activation scope increases the chance that the skill is selected for unrelated tasks, which may override better-matched skills or inject irrelevant instructions into normal conversations.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example trigger phrases are highly generic and resemble ordinary help requests rather than deliberate skill invocations. This makes it harder to distinguish normal conversation from explicit tool selection, increasing the likelihood of unintended activation and confusing routing behavior.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The default prompt uses highly generic terms such as "help me" and broad work/productivity language that can match many ordinary user requests, increasing the chance of unintended or silent invocation. Because implicit invocation is enabled, this creates a prompt-scope risk where the skill may activate outside its intended niche and influence unrelated conversations or workflows.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger sentences are so broad and generic that they can match ordinary user requests unrelated to this skill, causing accidental invocation or routing. In an agent ecosystem, overbroad activation can lead to inappropriate tool use, confusion, and unintended processing under the wrong workflow, especially because terms like 'help me' and 'I need a practical workflow' are common across many tasks.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.