Security audit

Work Productivity Skillscan Security Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with overly broad auto-activation triggers, but no evidence of credential access, code execution, persistence, or hidden data handling.

Before installing, consider narrowing or disabling implicit invocation because the skill may trigger on ordinary words like security, must, or before. The package does not show evidence of malicious behavior or sensitive access, but its broad routing may be noisy in a multi-skill setup.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 24)May include surrounding context.
md
- clawhub-popular-skill：[Popular Clawhub skill demand: PollyReach has 100,087 downloads](https://clawhub.ai/skills/pollyreach) - hacker-news-ask-hn：[Ask HN: What critical legacy system at work is everyone afraid to touch?](https://news.ycombinator.com/item?id=48902652) - hacker-news-ask-hn：[Tell HN: Staged NPM publishing is awful](https://news.ycombinator.com/item?id=48893354) - hacker-news-ask-hn：[Why can't you commit a .env file?](https://news.ycombinator.com/item?id=48904726) - hacker-news-ask-hn：[A/B Test results: Trying different homepage heroes got us 2.6x sign-ups](https://news.ycombinator.com/item?id=48894437) - github-issues：[Allow optional `run_id=` on Agent and UIAdapter entrypoints](https://github.com/pydantic/pydantic-ai/issues/6493) - github-issues：[Default regular Agent Deployments to satisfy restricted Pod Security](https://github.com/kagent-dev/kagent/issues/2244)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.zh-CN.md (reported line 24)May include surrounding context.
md
- clawhub-popular-skill：[Popular Clawhub skill demand: PollyReach has 100,087 downloads](https://clawhub.ai/skills/pollyreach) - hacker-news-ask-hn：[Ask HN: What critical legacy system at work is everyone afraid to touch?](https://news.ycombinator.com/item?id=48902652) - hacker-news-ask-hn：[Tell HN: Staged NPM publishing is awful](https://news.ycombinator.com/item?id=48893354) - hacker-news-ask-hn：[Why can't you commit a .env file?](https://news.ycombinator.com/item?id=48904726) - hacker-news-ask-hn：[A/B Test results: Trying different homepage heroes got us 2.6x sign-ups](https://news.ycombinator.com/item?id=48894437) - github-issues：[Allow optional `run_id=` on Agent and UIAdapter entrypoints](https://github.com/pydantic/pydantic-ai/issues/6493) - github-issues：[Default regular Agent Deployments to satisfy restricted Pod Security](https://github.com/kagent-dev/kagent/issues/2244)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/requirement-plan.md (reported line 43)May include surrounding context.
md
- clawhub-popular-skill：[Popular Clawhub skill demand: PollyReach has 100,087 downloads](https://clawhub.ai/skills/pollyreach) - hacker-news-ask-hn：[Ask HN: What critical legacy system at work is everyone afraid to touch?](https://news.ycombinator.com/item?id=48902652) - hacker-news-ask-hn：[Tell HN: Staged NPM publishing is awful](https://news.ycombinator.com/item?id=48893354) - hacker-news-ask-hn：[Why can't you commit a .env file?](https://news.ycombinator.com/item?id=48904726) - hacker-news-ask-hn：[A/B Test results: Trying different homepage heroes got us 2.6x sign-ups](https://news.ycombinator.com/item?id=48894437) - github-issues：[Allow optional `run_id=` on Agent and UIAdapter entrypoints](https://github.com/pydantic/pydantic-ai/issues/6493) - github-issues：[Default regular Agent Deployments to satisfy restricted Pod Security](https://github.com/kagent-dev/kagent/issues/2244)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords and example activation phrases are broad enough that unrelated user requests containing common words like 'security', 'every', 'must', 'before', or 'bug fix' could unintentionally activate the skill. In an agent ecosystem, unintended activation can cause the wrong workflow to run, producing incorrect actions or security-relevant guidance in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description says to use the skill when a user asks for broad concepts like "work-productivity," "security," or "implementation support," which creates an overly expansive activation scope. In a shared agent environment, this ambiguity increases the chance of accidental routing, prompt collision, and misuse in contexts the skill was not designed to handle safely.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list includes highly generic terms such as "security," "gate," "every," "must," "pass," and "before," which are common in ordinary user prompts. This can cause the skill to activate unintentionally in unrelated contexts, expanding its authority surface and potentially overriding more appropriate skills or workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: 触发关键词包含 security、every、must、pass、before 等非常宽泛且高频的日常词汇，容易让技能在大量无关对话中被误触发。误触发会把本应通用或其他领域的请求错误路由到该技能，造成越权介入、输出偏题，或在安全场景中掩盖真正应调用的更专门技能。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Enabling implicit invocation without tight trigger constraints allows the skill to be auto-selected for loosely related requests. In this case, the skill metadata is already overly broad, so implicit invocation compounds the risk by making accidental or inappropriate activation much more likely, including for security-sensitive or productivity-related requests outside its intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The keyword list includes generic terms like "security," "gate," "every," "must," and "before," which are common in normal conversation and not sufficiently distinctive for safe activation. This ambiguity can lead to accidental invocation and prompt-routing errors, especially in multi-skill systems where broad keyword matching can override more appropriate tools or workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger sentences are extremely broad and can match ordinary user requests about help, workflows, bug fixes, or hardening without clear scoping. In an agent ecosystem, this increases the chance of unintended or over-frequent activation, which can cause the skill to run in contexts the user did not explicitly intend and may interfere with routing or safety expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file is labeled as a Chinese README, but substantial user-facing content and the listed trigger phrases are written in English only. That can amount to forcing a language/locale on users without explicit opt-in, which conflicts with the policy requirement to avoid mandatory language constraints unless documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: 技能描述中的启用条件使用了宽泛表述，如“当用户提出 work-productivity, skillscan, security, gate, every，或需要围绕该需求获得实用流程、产物、检查清单、分析或实现支持时使用”，但没有定义清晰边界、优先级或排除范围。这会导致路由器或调用方难以判断何时真正应该启用该技能，从而扩大误用面并放大第 44 行宽泛关键词带来的误触发风险。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill name, short description, and default prompt are extremely broad and vague, covering generic "help," "workflow," "analysis," and implementation support. This increases the chance the platform will invoke the skill for unrelated everyday requests, causing overreach, unintended handling of user tasks, and unsafe routing of sensitive or security-relevant queries to a mismatched skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger sentences are broad enough to match common, non-specialized user requests such as generic help with productivity, security, or bug fixing. In agent-routing systems, this can cause the skill to activate outside its intended scope, exposing users to unintended workflows, misleading outputs, or expanded attack surface through unnecessary invocation of this skill.
Content: No source excerpt is available for this finding.