Work Productivity Weather Current Workflow Helper

• Outcome: Pass
• Latest audit: Jul 29, 2026 · 3:39 AM UTC
• Version: 0.20260729.110214

Overview

This is a documentation-only helper skill with overly broad activation wording but no executable code, hidden behavior, data access, persistence, or destructive capability.

Install only if you want a broad planning/checklist helper for weather-style workflow work. Be aware it may activate on generic weather, API, key, or workflow requests; explicit invocation by skill name is safer until the triggers are narrowed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger sentence is broad and natural-language-like, which increases the chance the skill is invoked unintentionally during ordinary user requests. Accidental invocation can route tasks into the wrong workflow, causing unexpected behavior, irrelevant actions, or unsafe chaining with other agent capabilities.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: This trigger pattern is generic enough to match many ordinary help requests, making accidental or over-broad activation likely. In an agent ecosystem, such ambiguous routing can cause the wrong skill to intercept prompts, reducing reliability and potentially exposing downstream tools or workflows to unintended use.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough to match common requests about productivity, weather, APIs, or bug fixing, which can cause the skill to activate outside its intended scope. Over-broad routing increases the chance of unintended execution, confusing behavior, and accidental exposure of the skill’s instructions or outputs in unrelated contexts.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The skill description is scoped so broadly that it can match many ordinary user requests unrelated to a narrowly defined weather workflow. In an agentic system, this increases the chance of unintended skill activation, causing the model to apply the wrong instructions, expose irrelevant capabilities, or interfere with higher-priority safer workflows.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger keywords include highly generic terms such as 'api', 'key', 'required', and 'users', which are common across many unrelated prompts. This makes accidental invocation very likely and can cause skill routing hijacks where this skill captures requests outside its intended domain, degrading reliability and potentially bypassing more appropriate controls.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Example triggers built around everyday phrases like 'Help me' and 'I need' normalize activation on common conversational language rather than on a distinctive intent signature. In systems that learn or validate routing from examples, this can broaden matching behavior and lead to frequent false activations.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger keywords include very broad terms such as 'weather', 'current', 'api', 'key', 'users', and 'required', which are common across many unrelated conversations. This can cause the skill to activate outside its intended scope, injecting irrelevant workflow instructions and potentially overriding a more appropriate skill or response path.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill description says it should be used when users ask for broad categories like work-productivity, weather, current, forecasts, or api, or whenever they need practical support around the requirement. That scope is vague enough to match many benign requests, increasing the chance of accidental invocation and unintended steering of the agent's behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The example trigger phrases are highly generic ('Help me...', 'I need a practical workflow...') and embed only partial fragments of the requirement text. These examples normalize activation from everyday language, which can further increase false triggers and make routing behavior unpredictable.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The default invocation prompt is highly generic and includes broad terms like 'help me' plus common domains such as work productivity and weather-style workflows. Because implicit invocation is enabled, this can cause the skill to trigger for ordinary user requests unrelated to the intended workflow, increasing the chance of unintended tool use, prompt hijacking exposure, or inappropriate handling of user data within the skill context.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to match ordinary user requests such as asking for a practical workflow or help with common work/productivity topics. This can cause the skill to activate outside its intended scope, leading to unintended prompt injection surface expansion, user confusion, and execution of irrelevant workflow logic in unrelated conversations.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.