Work Productivity Tavily Web Workflow Helper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 0.1.0

Overview

This is a documentation-only workflow helper with no executable code or hidden data access, though its auto-invocation terms are broader than ideal.

Before installing, be aware that this skill may activate on generic web/search/API phrasing. It is best used when you explicitly want Tavily-style search workflow planning, debugging, reliability, or hardening help.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description includes very broad activation terms such as 'work-productivity', 'web', 'search', and 'via', which are common in ordinary user requests and can cause the skill to be invoked outside its intended scope. Over-broad matching increases the risk of inappropriate routing, unintended instruction injection into unrelated tasks, and unsafe automation being applied where the user did not request this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trigger keyword list contains generic tokens like 'web', 'search', 'api', 'user', and 'alternative' without contextual qualifiers. In systems that auto-select skills from keywords, this can cause frequent false-positive activation, making the agent apply irrelevant or conflicting instructions and expanding the attack surface for prompt-routing abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are generic enough to match ordinary user requests such as asking for a practical workflow, bug fix, or hardening help, which can cause this skill to activate outside its intended scope. Over-broad activation increases the chance of incorrect skill selection, prompt-routing confusion, and unintended exposure of users to irrelevant or risky web-search workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are extremely broad and resemble normal user requests, which can cause accidental skill invocation outside the author's intended scope. In an agent environment, unintended invocation can misroute user tasks, trigger external-search behavior without clear consent, and increase prompt-surface exposure to untrusted web content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are generic natural-language requests such as 'Help me...' and 'I need a practical workflow...', which can match ordinary user intent rather than a clear, deliberate invocation of this specific skill. In an agent ecosystem, that increases the chance of accidental routing or unintended activation, which can cause the wrong workflow to run, produce irrelevant outputs, or bypass the user's expected tool-selection boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example trigger sentences use generic lead-ins like 'Help me' and 'I need a practical workflow' without clarifying the minimum conditions for activation. This encourages ambiguous invocation patterns and makes it more likely the skill will be selected for unrelated requests that happen to resemble normal assistant usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is provided as a Chinese-language regionalized version without offering user choice or fallback behavior, which can lead to misunderstanding of instructions, constraints, or safety guidance for users who do not read Chinese. While this is not directly exploitative, language mismatch can degrade safe operation and cause misconfiguration or incorrect execution of workflow advice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation description says to use the skill when users ask for broad terms like work-productivity, tavily, web, search, or practical workflow support, but it does not define exclusion conditions or decision boundaries. This ambiguity increases the chance of accidental invocation on unrelated tasks, which is especially risky in agent systems where skill selection may drive downstream actions or recommendations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords are overly broad (web, search, user, api, alternative, bug fix) and can match many unrelated requests, causing the skill to activate outside its intended Tavily-style workflow context. In an agent environment, this can route user tasks to the wrong skill, producing irrelevant guidance, bypassing more appropriate safeguards, or creating unsafe automation decisions through context confusion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The default prompt uses a very broad invocation phrase tied to common terms like work-productivity, tavily, web, and workflow support, which increases the chance the skill is invoked outside its intended scope. In an agent environment, over-broad routing can cause unintended tool use, prompt injection exposure through downstream web/search flows, or the application of this skill to unrelated user requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Enabling implicit invocation without a constrained trigger list allows the platform to auto-select this skill based on weak contextual matches. Because this skill is related to web/search workflows, accidental activation can expand the attack surface by introducing external-content handling in contexts where the user did not explicitly request it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The document presents an English README but includes the Chinese term "搜索" within a core skill name/reference, which may impose a locale-specific presentation without explaining user language selection. Because the file later mentions separate English and Chinese docs, the issue is limited, but the README itself does not explicitly state a language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The description includes the phrase "Tavily 搜索-style workflows," introducing a specific language/locale element in the natural-language guidance. Because the file does not state that multilingual wording is optional or user-selected, it can be read as imposing a locale choice without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language strings include both English and Chinese ('搜索-style') but do not indicate that multilingual output is optional, user-selected, or required for a specific region. This can violate language/locale policy expectations when a skill implicitly imposes a language choice without user opt-in or justification.

Content

No source excerpt is available for this finding.