Security audit

Work Productivity Skill Vetter Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with overly broad activation wording, but it does not request credentials, persistence, hidden execution, or destructive authority.

Reasonable to install if you want a lightweight skill-vetting workflow helper. Be aware that its trigger metadata is too broad and implicit invocation is enabled, so it may appear in unrelated security, GitHub, or workflow conversations; disabling implicit invocation or narrowing triggers would improve predictability.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match common requests such as 'security', 'first', 'before', 'github', or generic workflow/help prompts, which can cause the skill to activate outside its intended niche. In an agent ecosystem, overbroad invocation can misroute user tasks, increase unintended handling of sensitive requests, and create opportunities for prompt-surface abuse through accidental or unnecessary skill activation.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description includes very broad trigger terms such as 'security' and 'first' that can match many unrelated user requests, causing the skill to activate outside its intended scope. Overbroad routing can misapply this skill's guidance in sensitive contexts, increasing the chance of incorrect advice, confusion, or unintended workflow interception.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The keyword list contains ambiguous common-language terms including 'security', 'first', 'before', 'github', and 'bug fix', which are likely to overlap with a large volume of ordinary requests unrelated to this specific skill. This makes accidental invocation highly likely and can route users into the wrong workflow, especially in security-related conversations where precision and least-surprise behavior are important.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: 触发关键词包含“security”“first”“before”“github”等高频、语义宽泛的日常词，会让技能在大量无关上下文中被误触发。误触发本身不一定直接导致代码执行，但会扩大该技能介入决策和产出内容的机会面，增加错误建议、上下文劫持或覆盖更合适技能的风险。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Implicit invocation is enabled even though the skill metadata and prompt are not specific enough to ensure the skill activates only for clearly intended requests. In a security- and workflow-related helper, this can cause silent or surprising invocation on ordinary productivity or security queries, increasing the risk of prompt confusion, inappropriate tool selection, and unintended handling of sensitive context.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger sentence starts with very common language such as "Help me" and "I need," which can cause the skill to activate for broad, unrelated user requests. In a security- and vetting-oriented skill, overbroad activation is risky because it can unexpectedly steer conversations, inject workflow instructions, or override more appropriate skills in contexts where the user did not intend to invoke this behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger sentences are broad and loosely scoped, including generic terms like 'security', 'first', 'before', 'installing', and 'github', which can cause the skill to activate for unrelated user requests. In an agent ecosystem, ambiguous activation can route sensitive or high-trust workflows to the wrong skill, leading to misleading security guidance, unintended execution paths, or user confusion about what tool is handling the request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example trigger sentences are malformed and incomplete, so they do not provide reliable activation boundaries or clear intent signals. Poorly formed trigger examples can degrade classifier behavior and increase false activations or missed activations, which is risky for a skill dealing with security and vetting workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: 描述中的启用条件覆盖“work-productivity, skill-vetter, vetter, security, first”以及任何需要“workflow/checklist/analysis/implementation support”的请求，边界非常模糊。这样的范围会让技能在大量普通生产力或安全相关请求中被激活，造成路由混乱、结果不相关，甚至影响用户对安全建议的信任。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The default prompt uses broad, generic language such as 'help me' and references common terms like workflow, security, and analysis without tight activation boundaries. This increases the chance of unintended routing or invocation in unrelated user conversations, which can expose users to unexpected behavior, incorrect context selection, or over-broad use of a security-oriented helper.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: 该技能正文整体以中文编写，且文件内未见提示用户可选择其他语言或说明这是一个本地化版本。按规则，若技能在自然语言层面强制特定语言而没有用户选择或明确正当说明，可能构成语言/地区策略问题。
Content: No source excerpt is available for this finding.