Security audit

Work Productivity Skill Vetter Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with sloppy, overbroad activation language but no evidence of credential access, code execution, persistence, or data exfiltration.

Install only if you want a lightweight helper for creating skill-vetting workflows or checklists. Be aware that its trigger words are overly broad, so it may activate in unrelated security or GitHub conversations unless your runtime uses stricter routing or you narrow the invocation terms.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
md
- clawhub-popular-skill：[Popular Clawhub skill demand: Github has 193,054 downloads](https://clawhub.ai/skills/github) - clawhub-popular-skill：[Popular Clawhub skill demand: SkillScan has 179,470 downloads](https://clawhub.ai/skills/skillscan) - hacker-news-ask-hn：[What's the first thing you look up when evaluating a company?](https://news.ycombinator.com/item?id=48898310) - hacker-news-ask-hn：[Why can't you commit a .env file?](https://news.ycombinator.com/item?id=48904726) - github-issues：[Default regular Agent Deployments to satisfy restricted Pod Security](https://github.com/kagent-dev/kagent/issues/2244) ## 这个技能如何满足需求

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.zh-CN.md (reported line 21)May include surrounding context.
md
- clawhub-popular-skill：[Popular Clawhub skill demand: Github has 193,054 downloads](https://clawhub.ai/skills/github) - clawhub-popular-skill：[Popular Clawhub skill demand: SkillScan has 179,470 downloads](https://clawhub.ai/skills/skillscan) - hacker-news-ask-hn：[What's the first thing you look up when evaluating a company?](https://news.ycombinator.com/item?id=48898310) - hacker-news-ask-hn：[Why can't you commit a .env file?](https://news.ycombinator.com/item?id=48904726) - github-issues：[Default regular Agent Deployments to satisfy restricted Pod Security](https://github.com/kagent-dev/kagent/issues/2244) ## 这个技能如何满足需求

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/requirement-plan.md (reported line 40)May include surrounding context.
md
- clawhub-popular-skill：[Popular Clawhub skill demand: Github has 193,054 downloads](https://clawhub.ai/skills/github) - clawhub-popular-skill：[Popular Clawhub skill demand: SkillScan has 179,470 downloads](https://clawhub.ai/skills/skillscan) - hacker-news-ask-hn：[What's the first thing you look up when evaluating a company?](https://news.ycombinator.com/item?id=48898310) - hacker-news-ask-hn：[Why can't you commit a .env file?](https://news.ycombinator.com/item?id=48904726) - github-issues：[Default regular Agent Deployments to satisfy restricted Pod Security](https://github.com/kagent-dev/kagent/issues/2244) ## 这个技能如何满足需求

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description includes extremely broad activation terms such as 'security' and 'first', which are common in many unrelated user requests. This can cause the skill to activate outside its intended scope, leading to inappropriate routing, unexpected prompt influence, or accidental interception of sensitive workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The trigger keyword list contains ambiguous everyday words like 'security', 'first', 'before', and 'github' without any scoping constraints. In agent systems that use keyword matching or loose routing, these terms can spuriously invoke the skill for many unrelated tasks, increasing the chance of mis-execution or untrusted prompt injection into other workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger phrases are broad enough to match ordinary requests containing generic words like 'security', 'first', 'github', or 'bug fix', which can cause the skill to activate outside its intended scope. In an agent environment, overbroad activation can route unrelated user tasks into this workflow, producing incorrect handling, scope confusion, or unwanted access to context and tools.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are vague and overbroad, including generic terms like 'security', 'first', and 'github', which can cause the skill to activate in unrelated contexts. In an agent environment, this increases the chance of unintended invocation, context hijacking, or application of this workflow where a more appropriate or safer skill should have been used.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary user requests such as 'security', 'first', or 'github', which can cause the skill to activate outside its intended scope. In an agent ecosystem, overbroad invocation expands the chance that this workflow handles unrelated tasks, increasing prompt-surface exposure and the risk of accidental misuse or unsafe chaining.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example trigger sentences are malformed, truncated, and do not define clear invocation boundaries, which makes it harder for users and routing systems to distinguish intentional use from incidental matching. Ambiguous examples reinforce overbroad activation behavior and can cause accidental selection of this skill in unrelated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description says it should be used for broad categories like work-productivity, security, and practical workflow or analysis support, without clearly limiting what kinds of requests are in or out of scope. This ambiguous boundary makes accidental or overly aggressive invocation more likely, which is especially risky because the skill presents itself as applicable to security-adjacent tasks where precision in routing matters.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very broad, high-frequency terms such as "security", "first", "before", and "github", which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance that this skill intercepts requests outside its intended scope, leading to workflow confusion, incorrect tool selection, or unintended influence over security-related user tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default prompt uses very broad trigger language such as common terms like 'work-productivity', 'security', 'first', 'workflow', and 'checklist', which can cause the skill to activate in unrelated conversations. Because implicit invocation is enabled, this increases the chance of unintended routing or prompt injection surface expansion where normal user text accidentally calls the skill. In a security-oriented vetter workflow, accidental activation is more dangerous because the skill may influence analysis or handling of sensitive content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation guidance does not define clear boundaries for when the skill should or should not run, increasing the chance of accidental invocation. Without specificity and negative examples, orchestrators or users may apply the skill to unrelated prompts, leading to misexecution and potentially exposing more context than necessary to the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The file describes separate English and Chinese instruction variants, but does not state how the user's preferred language is selected or that language choice is optional. This can create a locale-policy concern if the skill defaults users into a language without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Although this is presented as a Chinese README, key descriptive and trigger content is written in English, including the activation phrases and core workflow description. This can effectively impose English interaction expectations without explicitly offering the user a language or locale choice.
Content: No source excerpt is available for this finding.