Self-Improving Workflow Helper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:13 AM UTC
• Version: 0.1.0

Overview

This is a documentation-only workflow skill whose broad auto-invocation settings deserve caution but do not show hidden, destructive, or data-stealing behavior.

Before installing, be aware that the skill may be invoked implicitly for broad workflow-improvement language. Use it when you intentionally want postmortem-style improvements, prompt or runbook changes, and replay validation; review any durable prompt, skill, memory, or runbook update before applying it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger sentences are extremely broad and can match generic user requests for help, practical workflows, or agent productivity topics rather than a narrowly scoped intent. That creates unintended skill activation and prompt routing risk, where this skill could intercept unrelated tasks and influence behavior outside its intended boundary, especially in agentic systems that auto-select skills from trigger text.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: In this markdown file, the trigger examples at L39-L40 are natural-language requests that could plausibly appear in ordinary discussion, especially 'Create a feedback loop for recurring review comments.' The README does not clearly bound when these phrases should invoke the skill versus when they are just general brainstorming, and it provides no exclusion conditions or negative examples.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description and activation guidance are broad enough to match many ordinary requests about workflow improvement, review support, or documentation, which can cause the skill to be invoked outside its narrow intended scope. In an agent-routing context, overbroad triggers increase the chance of inappropriate skill selection, potentially steering tasks into self-modifying or instruction-updating workflows when simpler or safer skills should be used.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The keyword list uses generic phrases like 'runbook', 'prompt update', 'quality review', and 'workflow improvement' without qualifiers, making accidental activation likely. In a self-improving workflow skill, mistaken activation is more sensitive because the skill explicitly deals with updating prompts, skills, tests, and runbooks, so misrouting can amplify changes to operational guidance or agent behavior.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description declares broad activation conditions such as requests related to self-improving agents, feedback loops, runbooks, prompt updates, and review support without enough boundary conditions. This can cause the skill to be invoked for loosely related requests, leading to unintended workflow generation or instruction influence in contexts where another skill or tighter review process should apply.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger keyword list is short, generic, and lacks scope constraints or negative examples, so ordinary user phrasing may match accidentally. In a routing or auto-invocation system, ambiguous triggers can misroute tasks to this skill, increasing the chance of inappropriate prompt updates or self-improvement guidance being applied outside intended guardrails.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation while advertising a very broad, workflow-oriented purpose, which increases the chance it will be auto-selected in contexts the user did not explicitly request. Because this skill is designed to modify workflows, instructions, or durable skill updates, unintended invocation could cause silent prompt/process drift, incorporation of unvetted lessons, or unauthorized changes to operating guidance.

Natural-Language Policy Violations

Low

• Confidence: 75% confidence
• Finding: The README lists English and Chinese instruction and guide files, but it does not say how the user's preferred language is selected or that language choice is optional. Because language/locale policy violations apply to all file types, this can be read as a fixed bilingual packaging decision without explicit user opt-in or selection behavior.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The file identifies itself specifically as a Chinese user guide via `README.zh-CN.md`, and the content is presented only in Simplified Chinese without any language choice within the document. Under the policy rule, forcing a specific language/locale without user opt-in can be a natural-language policy violation unless clearly justified.

Static analysis

No suspicious patterns detected.