Work Productivity Self Improving Workflow Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 5:43 AM UTC
• Version: 0.20260729.110214

Overview

This is a documentation-only workflow helper with overly broad trigger wording but no hidden execution, credential use, persistence, or data movement.

Before installing, be aware that the skill may be selected too often because its triggers are broad and implicit invocation is enabled. It appears safe as a workflow helper, but authors should narrow activation to explicit self-improving agent workflow requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad and include generic terms like 'self', 'improving', 'logs', and common help-request formulations, which can cause the skill to activate for ordinary unrelated prompts. This can lead to unintended routing or invocation, increasing the chance that the wrong workflow is applied to user requests and potentially bypassing more appropriate specialized handling.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests such as 'help me' and generic productivity or bug-fix prompts, which can cause the skill to activate outside its intended scope. In an agent ecosystem, overbroad activation can route unrelated user inputs into this workflow, increasing the chance of unintended behavior, prompt collisions, or misuse of a self-improving workflow in contexts where it was not requested.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger list includes extremely broad terms like "self," "improving," and "logs," which are common in ordinary user requests and can cause the skill to activate far outside its intended scope. This increases the chance of inappropriate routing, unexpected behavior, and interference with more relevant skills, especially in automated skill-selection systems.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The description says to use the skill when a user asks for broad categories like "work-productivity" or needs a "practical workflow, artifact, checklist, analysis, or implementation support," which are generic request types applicable to many unrelated tasks. Such an expansive invocation condition can cause over-selection of this skill and degrade routing accuracy, potentially exposing users to irrelevant or lower-quality guidance.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example trigger phrases are written in generic everyday language and largely repeat broad demand statements rather than precise activation criteria. In systems that learn or match from examples, this can encourage accidental invocation on loosely related user messages, amplifying the skill's already overbroad scope.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger list includes extremely generic terms such as "self", "improving", "logs", and "own", which are common in ordinary user conversations and likely to cause accidental invocation. This can route unrelated requests into this skill unexpectedly, leading to incorrect behavior, overreach, or unintended processing in contexts where the skill is not appropriate.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The manifest description says to use the skill when a user asks for broad topics like work-productivity, self, improving, or logs, plus any request for a practical workflow, artifact, checklist, analysis, or implementation support. This is so expansive that the skill may be selected for many unrelated tasks, increasing the chance of misrouting, unintended autonomy, and exposure of user context to an irrelevant skill path.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The default prompt uses a very broad trigger phrase and generic wording, which can cause the skill to be invoked in contexts beyond the author's intended scope. In a self-improving workflow/helper skill, this increases the chance of unintended activation, prompt confusion, or overlap with unrelated tasks, which can expose users to unsafe automation behaviors or misleading outputs.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger sentences are broad and closely mirror ordinary user phrasing, which can cause the skill to activate unintentionally for unrelated requests. In an agent ecosystem, overbroad activation can misroute tasks, override more appropriate skills, and increase the chance that the agent applies this workflow in contexts where its assumptions do not fit.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.