Work Productivity Self Improving Workflow Helper

• Outcome: Pass
• Latest audit: Jul 26, 2026 · 1:42 AM UTC
• Version: 0.1.0

Overview

This is a documentation-only workflow helper with overly broad activation wording, but it does not install code, request credentials, persist, or perform hidden actions.

Before installing, understand that this skill may be selected for ordinary productivity or self-improvement phrasing because its triggers are broad. It is best used when you explicitly want help designing or improving agent workflow checklists, reliability plans, or related implementation artifacts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger sentence is broad and close to natural user phrasing, so the skill may activate when a user is merely discussing self-improving or proactive workflows rather than explicitly requesting this skill. In an agent ecosystem, unintended invocation can route user requests into the wrong workflow, causing confusing actions, irrelevant outputs, or accidental execution of steps the user did not clearly opt into.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: This trigger remains too generic because 'I need a practical workflow for...' is ordinary language that could appear in many benign conversations. If matching is done loosely, the skill can be invoked without deliberate user consent, increasing the chance of unintended workflow execution or priority hijacking over more appropriate skills.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad, generic, and include common words like "self," "improving," and "proactive," which can cause the skill to activate for unrelated everyday requests. In an agent environment, unintended invocation can route benign user tasks into a self-improving or workflow-altering skill, increasing the chance of inappropriate actions, prompt hijacking of task flow, or user confusion.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list includes extremely generic terms like "self," "improving," and "proactive," which are common in ordinary conversation and can cause the skill to activate far outside its intended scope. In an agent ecosystem, this kind of overbroad routing can hijack unrelated user requests, leading to prompt misapplication, degraded reliability, and unintended behavior chaining.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The description says to use the skill whenever a user asks for broad concepts like work-productivity, self, improving, or proactive, which makes invocation criteria ambiguous and excessively broad. This increases the chance that orchestration or human operators select the skill for unrelated tasks, creating unsafe prompt routing and reducing trust in downstream agent behavior.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The example triggers repeat broad, marketing-style language instead of demonstrating precise activation conditions, reinforcing accidental invocation patterns. Because examples often guide both users and automated selection heuristics, vague trigger examples can amplify misrouting across many normal conversations.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger list includes extremely broad everyday terms such as "self", "improving", and "proactive", which can cause the skill to activate in many unrelated conversations. This increases the chance of unintended routing, prompt/context injection into unrelated tasks, and user confusion because the skill may take over interactions it was not meant to handle.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The description uses broad "or" activation logic covering generic terms and vague needs like wanting a "practical workflow, artifact, checklist, analysis, or implementation support," which matches a very large portion of normal requests. In practice, this can cause over-activation of the skill and unintended access to conversations outside its intended scope, making prompt selection unreliable and potentially unsafe.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The default prompt is overly broad and vague, effectively encouraging invocation for a wide range of loosely related requests without clear boundaries or eligibility checks. In combination with allow_implicit_invocation: true, this can cause the skill to be triggered in contexts the user did not clearly intend, increasing the risk of prompt hijacking, inappropriate delegation, or unsafe workflow execution.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger phrases are broad, repetitive, and include generic words such as 'self', 'improving', and 'proactive', which can cause the skill to activate in unrelated conversations. In an agent ecosystem, unintended invocation can route user requests into the wrong workflow, causing incorrect automation, confusion, or execution of actions under mismatched assumptions.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.