Security audit

Work Productivity Tavily Web Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-style workflow helper with no executable code, persistence, credential handling, or hidden data movement, though its auto-invocation scope is broader than ideal.

Install only if you want a broad workflow helper for Tavily or similar web-search workflow planning. Be aware that implicit invocation and generic keywords may make it appear for unrelated web, search, API, or bug-fix requests; users or platform maintainers may want to narrow the trigger terms before publishing widely.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description is so broad that it can match many ordinary requests containing terms like work-productivity, web, search, or analysis, causing the skill to activate outside its intended scope. In agent systems, over-broad routing can expose users to irrelevant instructions, unintended tool usage patterns, and reduced trust in skill selection, especially when the skill claims authority over a wide class of workflow tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger keyword list contains highly generic tokens such as web, search, api, user, and alternative, which are common across unrelated tasks. This makes accidental invocation likely and can let the skill override more appropriate domain-specific skills, creating prompt-routing confusion and increasing the chance of unsafe or low-relevance behavior in multi-skill environments.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: 触发关键词包含“web”“search”“api”“user”等高度通用词，且示例触发句也非常宽泛，容易在大量无关请求中误触发该技能。误调用会把用户带入与原问题不匹配的 Tavily/web workflow 路径，造成错误建议、上下文污染或把后续操作引向不必要的外部搜索/流程。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentences are phrased as broad natural-language requests rather than narrowly scoped invocation patterns, which increases the chance the skill will activate on ordinary user text that merely resembles the requirement description. In an agent ecosystem, unintended invocation can misroute tasks, cause workflow confusion, and expand the effective attack surface by letting unrelated prompts trigger this skill unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough to match ordinary requests about help, workflows, bug fixes, and hardening, which can cause the skill to activate outside its intended scope. In an agent ecosystem, overbroad invocation increases the chance of unintended routing, prompt interference, or the skill being selected for unrelated tasks where it may shape outputs incorrectly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad, generic, and include common workflow terms like 'help me', 'practical workflow', 'web', and 'bug fix', which can cause the skill to activate in contexts far outside its intended Tavily-style search workflow scope. Over-broad activation increases the chance of prompt/skill hijacking, accidental invocation, and inappropriate handling of unrelated user tasks, especially in agent ecosystems where skill routing is automated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example triggers use vague wording like help me or I need a practical workflow, which provides little guidance for distinguishing valid activation from ordinary user requests. Without contrasting non-trigger examples, integrators may implement permissive matching that broadens the attack surface for misrouting and unintended skill execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: 文件名与内容表明该技能为 zh-CN 版本，但正文未说明这是用户可选语言，也未提供语言切换或确认机制。若该技能在更广泛环境中被默认使用，可能构成未经用户选择的语言/区域约束。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 技能描述中的适用范围覆盖“work-productivity, tavily, web, search, via”及“需要实用流程、产物、检查清单、分析或实现支持”等宽泛表述，但缺少清晰边界和不适用场景。这样会放大路由歧义，使系统在不该调用该技能时调用它，降低回答准确性，并可能把一般性请求错误地映射到特定工作流。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default prompt and description use very broad terms like 'work-productivity', 'web', 'search', 'workflow', 'artifact', and 'analysis' without clear boundaries, making the skill eligible for activation in many unrelated contexts. This can cause unintended routing of user requests to the skill, increasing the chance of over-collection of user context, incorrect tool use, or unsafe assistance outside the intended Tavily-specific use case.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Enabling implicit invocation without narrow scope or exclusion criteria allows the platform to auto-select this skill based on weak semantic matches. In combination with the broad prompt wording, this increases the risk of the skill being invoked for unintended requests, which can mis-handle user intent or apply workflow/search behavior where it is not appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The keyword list includes broad terms like 'web', 'search', 'api', 'alternative', 'user', and 'bug fix', which are common across many unrelated tasks and can cause overmatching. In a routing or auto-selection system, this can lead to accidental skill invocation, incorrect tool usage, and reduced trust in the agent's decision-making, especially because the skill is positioned as a general workflow helper.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document includes Chinese text ('搜索-style') within the English README, and references separate English and Chinese skill files, but does not explain how language selection is determined for users. This can create an implicit locale behavior without clear opt-in or documented policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language description and default prompt include Chinese text ('搜索-style') without indicating that language choice is optional or user-selected. This can violate language/locale policy expectations when a skill implicitly imposes a language preference rather than offering a choice.
Content: No source excerpt is available for this finding.