Security audit

Work Productivity Skill Vetter Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plain workflow helper with overly broad activation wording, but it does not include code, credential use, persistence, or privileged actions.

Install only if you want a lightweight workflow helper for Skill Vetter-style planning. Be aware it may be invoked too often because terms like security, first, before, github, and bug fix are very broad; narrowing triggers would make it safer and less distracting.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger phrases are extremely broad and include common terms like 'security', 'first', 'before', 'github', and generic help-style sentences, which can cause the skill to activate for many unrelated user requests. In an agent ecosystem, this creates routing confusion and unexpected invocation of a workflow that may influence user actions or analysis in contexts where it was not intended, increasing the risk of prompt hijacking, mis-scoping, or accidental overreach.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description includes very broad activation terms such as 'security' and 'first' that can match many unrelated user requests. This can cause the skill to activate outside its intended scope, creating prompt-routing confusion and increasing the chance that users receive irrelevant or overly trusted workflow guidance in sensitive contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger keyword list contains ambiguous, generic words like 'security', 'first', 'before', 'github', and 'bug fix' with no contextual guardrails. In a skill-dispatch system, this can cause widespread accidental invocation on common requests, potentially intercepting unrelated security or development tasks and steering users into an inappropriate workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger keywords are overly broad and include common terms such as 'security', 'first', 'before', 'github', and 'bug fix', which can overlap with many unrelated user requests. This can cause accidental activation of the skill in contexts where it was not intended, increasing the chance that it intercepts prompts, overrides more appropriate skills, or introduces irrelevant workflow guidance into security-sensitive conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger sentences and keywords are broad enough to match many ordinary requests about security, bug fixing, GitHub, or workflow help, which can cause the skill to activate outside its intended scope. In an agent ecosystem, overbroad invocation can misroute user tasks, suppress more appropriate skills, and increase the chance that users rely on a generic vetting workflow in contexts where precision and least-privilege routing matter.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger examples are broad and loosely phrased around common terms like 'security', 'github', 'before', and 'bug fix', which can cause the skill to activate in contexts the user did not intend. In a vetting or workflow-helper skill, unintended invocation can misroute tasks, confuse security-sensitive workflows, or cause users to rely on the wrong automation path during analysis or setup.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This is presented as a Chinese README, but key descriptive content and trigger text remain in English. That can amount to an implicit language policy mismatch because the file does not tell users they can choose language or that English-only portions are intentional.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example trigger sentences are malformed and overly broad, so they do not establish clear activation boundaries for when the skill should run. Poor examples can reinforce permissive matching behavior and make maintainers more likely to accept noisy routing that surfaces this skill in unrelated conversations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The default prompt embeds a very broad invocation phrase tied to common terms like 'work-productivity', 'security', 'first', 'analysis', and 'implementation support', which can overlap with ordinary user requests. Because implicit invocation is enabled, this increases the chance the skill is triggered unexpectedly, causing prompt injection of the skill’s instructions into unrelated conversations and potentially altering agent behavior without clear user intent.
Content: No source excerpt is available for this finding.