Work Productivity Tavily Web Workflow Helper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 0.20260729.110214

Overview

This is a documentation-only workflow helper with overly broad triggers, but it does not contain code, credential access, persistence, or hidden behavior.

Before installing, consider whether you want a broadly triggered helper for Tavily/web-search workflow tasks. It appears safe as documentation, but its activation terms should ideally be narrowed to explicit Tavily or web-search workflow requests to avoid irrelevant use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description is broad enough to match many ordinary requests about productivity, web, search, or implementation help, which can cause unintended activation outside its intended scope. Over-broad routing is dangerous because it can inject irrelevant instructions into unrelated tasks, increasing the chance of incorrect tool use, workflow confusion, or policy bypass through opportunistic triggering.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The keyword list includes highly generic terms such as 'web', 'search', 'api', 'alternative', 'user', and 'bug fix', which are common across many unrelated conversations. This makes accidental or adversarial invocation much more likely, allowing the skill to hijack routing for broad classes of requests and apply instructions in contexts where they do not belong.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger keywords include very common terms such as "web", "search", "api", and "user", which can cause the skill to activate for many unrelated requests. This creates unintended routing risk: users may be steered into this skill when they did not ask for it, producing irrelevant actions, confusing outputs, or overshadowing a more appropriate skill.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger sentence is broad enough to match ordinary user phrasing about getting help or needing a workflow, which can cause the skill to activate when the user did not explicitly intend to use it. In agent systems, overbroad activation can misroute tasks, override more appropriate skills, and create unsafe tool usage chains if the wrong skill gains control.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad enough to match routine user requests about work productivity, web search, APIs, or bug fixing, which can cause the skill to activate outside its intended scope. In an agent ecosystem, overbroad activation can route unrelated conversations into this skill, increasing the chance of unintended tool use, confusing outputs, or policy bypass through prompt collision with more specific skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary user requests, which can cause the skill to activate outside its intended scope. In an agent environment, overbroad activation can route unrelated prompts into this workflow, creating prompt-selection confusion and increasing the chance that web/search behaviors are invoked unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example triggers use commonplace language and do not establish clear scope constraints, so they normalize activation on vague requests rather than precise Tavily-related workflow needs. In systems that learn or match from examples, such loose phrases can widen the effective trigger surface and increase false activations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file is explicitly a zh-CN localized skill document, but it does not state that language selection is optional or user-driven. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example trigger phrases are broad natural-language requests that resemble ordinary user prompts and lack precise activation constraints. In systems that use examples to guide invocation, this can widen the match surface and increase accidental activation, leading to incorrect workflow selection or prompt-routing interference.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default_prompt uses a very broad invocation phrase tied to common productivity and Tavily/web-search terminology, which can cause the skill to be triggered for ordinary user requests that were not intended to invoke it. Because implicit invocation is enabled, this increases the chance of prompt-space collisions, unintended routing, and activation of skill behavior in unrelated contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

An ambiguous trigger without activation boundaries or negative examples makes it hard for the orchestrator to distinguish intended use from normal conversation. This increases accidental invocation risk and can reduce reliability, especially because the skill is framed as broadly useful for workflows, artifacts, and implementation support.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file list explicitly presents only English and Chinese instruction and guide files, but does not state that users may choose their preferred language or that the skill adapts to user locale. This can indicate a language-policy issue when documentation implies fixed language options without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This Chinese README presents the user-facing trigger phrases only in English, which effectively imposes a language choice in the skill instructions without stating that users may use Chinese or select their preferred language. That can be a natural-language locale policy issue because the document targets zh-CN users but does not offer opt-in language flexibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The description embeds the Chinese term '搜索-style' within the primary natural-language description, which may impose or assume mixed-language usage without user opt-in. There is no explanation that the skill is intentionally bilingual or region-specific, and no option for the user to choose language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The requirement description embeds the Chinese term '搜索' within the skill framing, and the file does not state whether multilingual phrasing is intentional, optional, or user-selected. This can create an implicit language/locale assumption without explicit opt-in or justification.

Content

No source excerpt is available for this finding.