Security audit

Work Productivity Tavily Web Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with no executable code, but its activation wording is too broad and may trigger in unrelated web or API requests.

Before installing, consider narrowing or disabling implicit invocation so ordinary web, search, API, or bug-fix requests do not accidentally route through this skill. There is no evidence of malicious code or hidden data access in the inspected files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description and usage guidance are broad enough to match many ordinary requests involving 'web', 'search', 'api', or general productivity help, which can cause the agent to invoke this skill outside its intended scope. Over-broad activation increases the chance of prompt-routing errors, irrelevant instruction injection into unrelated tasks, and degraded safety because users may receive workflow guidance that was never meant for their context.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The keyword list includes highly generic triggers such as 'web', 'search', 'api', 'alternative', 'user', and 'bug fix', any of which commonly appear in unrelated conversations. In an agentic environment, this can cause frequent false activations, unintentionally inserting this skill's instructions into unrelated workflows and increasing the risk of misrouting, policy interference, or user-confusing outputs.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger sentences are broad, natural-language phrases that can match ordinary user requests rather than an explicit invocation. That increases the chance of unintended activation, causing the skill to steer unrelated conversations, inject irrelevant workflow behavior, or override user intent in contexts involving web/search tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger sentences are written as broad natural-language requests that overlap with ordinary user phrasing rather than narrowly identifying this specific skill. That can cause accidental invocation in unrelated contexts, leading the agent to route tasks to this skill unexpectedly and potentially apply web-search or workflow behavior the user did not intend.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad, repetitive, and match generic user requests such as 'I need a practical workflow' or 'Help me', which can cause unintended invocation in unrelated conversations. In an agent ecosystem, overbroad activation increases the chance that this skill runs in the wrong context, potentially routing user prompts into web-search/API workflows the user did not explicitly request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example trigger sentences are vague and repetitive, and they do not demonstrate where the skill should or should not activate. Ambiguous examples make routing behavior harder to validate and encourage accidental invocation on loosely related user requests, especially when paired with the already broad keyword list.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The usage condition in the description is vague and expansive, stating the skill should be used when a user asks for broad categories like work productivity, web, search, or practical support. This unclear boundary increases the chance that the system selects the skill outside its intended scope, which can mislead users or apply unsuitable guidance to unrelated requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger keywords are extremely broad (web, search, user, api, alternative, bug fix) and overlap with many normal requests, making accidental invocation likely. In an agent environment, overbroad activation can route unrelated tasks into this skill, causing inappropriate instructions, workflow confusion, or unsafe handling if the skill’s assumptions do not match the user’s intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default prompt trigger is broad and overlaps with ordinary user language such as 'help me' and generic productivity/search workflow terms. In combination with a skill designed for common web-search and workflow assistance, this increases the chance of unintended activation, causing the agent to inject this skill's behavior into unrelated conversations or tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Implicit invocation is enabled even though the manifest does not define tight activation boundaries or scoped conditions. Because the skill addresses very common topics like productivity, web, and search, the agent may auto-select it in many contexts, creating prompt-routing confusion, unintended tool use, or privilege expansion through accidental invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: This file is named as a Chinese README, but substantial instructional content and trigger phrases remain in English. Because the document does not state that English is required or offer an explicit language choice, it may impose a language preference without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The description embeds the Chinese term "搜索-style" within the default skill narrative without explaining language choice or offering user preference. While minor, this can conflict with a language/locale policy if the skill is expected to avoid imposing language-specific wording without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: 该技能文件为 SKILL.zh-CN.md，内容整体以简体中文面向 zh-CN 语境呈现，但未见向用户提供语言选择或说明仅在中文环境下使用的理由。按自然语言策略要求，若技能隐含强制特定语言/locale 而无用户选择，可能构成语言/地区策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The description and default prompt include Chinese text ("搜索") embedded in otherwise English content, but the manifest does not state that language selection is user-driven or justified by a region-specific purpose. This can amount to an implicit language/locale preference without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The requirement description explicitly references "Tavily 搜索-style workflows," mixing Chinese-language wording into the skill description without explaining a locale requirement or offering a language choice. This can create an implicit language expectation that is not documented as optional or region-specific.
Content: No source excerpt is available for this finding.