Work Productivity Skill Vetter Workflow Helper

• Outcome: Review
• Latest audit: Sep 7, 2026 · 4:22 AM UTC
• Version: 0.20260907.40414

Overview

This skill appears documentation-only and not malicious, but it can auto-trigger on very common requests, so it needs review before installation.

Review this skill carefully if you install it: it does not appear to run code or access private data by itself, but its trigger rules are too broad and may cause it to influence ordinary security, GitHub, or bug-fix conversations where you did not intend to use this workflow helper.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger sentences are broad, generic, and likely to match common user requests unrelated to this specific skill, which can cause the skill to activate in contexts the user did not intend. In a security- and vetting-oriented skill, over-triggering is more dangerous because it may insert analysis workflows, recommendations, or trust decisions into unrelated conversations and increase the chance of unsafe or misleading automation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger keywords and example phrases are broad enough to match common security-, GitHub-, and workflow-related requests that may not specifically intend to invoke this skill. In an agent-routing context, this can cause unintended activation, leading the agent to apply the wrong workflow, produce irrelevant actions, or interfere with safer or more specific skills.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger keywords are extremely broad, including generic terms like "security," "first," "before," and "github," which can cause the skill to activate in many ordinary conversations unrelated to this skill’s intended scope. Over-broad activation increases the chance of unintended routing, context hijacking, or shadowing more appropriate skills, which is a genuine security and reliability concern in agent ecosystems.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The manifest description says to use the skill when a user asks for broad categories like "security" or "implementation support," which are common across many benign requests and do not define clear invocation boundaries. Ambiguous activation guidance can make the skill over-match unrelated prompts, leading to accidental invocation and expanding the skill’s influence beyond its intended domain.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example trigger phrases are vague and partially malformed, and they mirror broad natural-language requests that many users might say in unrelated contexts. Poorly bounded examples teach the routing layer to match on nonspecific wording, which can degrade precision and cause unintended activations, though the impact is somewhat lower than explicit broad keyword declarations.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger keywords include extremely broad everyday terms such as “security”, “first”, “before”, and “github”, which can cause the skill to activate in many unrelated conversations. Overbroad triggering is dangerous because it can hijack routing, suppress more appropriate skills, and cause users to receive irrelevant or lower-safety guidance in contexts where precision matters.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The description says to use the skill when a user asks for broad categories like work-productivity, security, or practical workflow/artifact/checklist support, without clearly limiting scope to this specific use case. This ambiguity increases unintended invocation risk and can route general requests into this skill even when the user did not ask for skill-vetting or adjacent workflows.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The default prompt uses broad, generic trigger language such as 'help me' combined with a wide set of common work-related terms, which increases the chance of unintended or implicit activation. Because the policy also enables implicit invocation, the skill may be invoked in contexts the user did not clearly intend, causing prompt injection surface expansion and accidental disclosure or execution of workflow logic in unrelated conversations.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger sentences are broad enough to match many normal requests about security, bug fixing, GitHub, or workflow help, which can cause the skill to activate outside its intended scope. Over-broad routing increases the chance of incorrect delegation, prompt-surface expansion, and accidental use of this skill in contexts where its assumptions or behaviors are not appropriate.

Static analysis

No suspicious patterns detected.