feel good productivity + atom habits

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:34 PM UTC
• Version: 1.0.2

Overview

This is a local personal-productivity skill that is broadly coherent and disclosed, with user-review notes around local file persistence and migration cleanup.

Install this if you want an assistant to maintain a local plaintext productivity system. Before running setup or migration, review the exact ~/productivity/ paths, back up any existing productivity notes, and do not delete legacy folders until you have verified the migrated content. Treat burnout material as self-help guidance, not medical or mental-health care.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The migration guide contains inconsistent safety guarantees: earlier sections instruct deleting files and directories directly, while the post-migration checklist says no legacy file was deleted without explicit user approval. In a file-system management skill, this contradiction can cause an agent or user to trust the migration as non-destructive and then perform irreversible deletions anyway.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are broad enough to match many ordinary planning requests, which can cause the skill to activate in situations where the user did not clearly intend to use this specific productivity system. That increases the chance of inappropriate routing, unnecessary file-writing suggestions, or over-collection of personal planning data within the local productivity workspace.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The task-breakdown activation conditions are ambiguous and include generic expressions like 'I don't know where to start' and 'break into chunks,' which can over-trigger the skill for many unrelated requests. In this context, over-activation is more concerning because the skill is designed to structure user goals and potentially write detailed personal productivity artifacts, so mistaken invocation can steer users into an unintended system workflow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document gives advice on severe burnout, including cases where a person may be unable to function, but it does not warn users that this is not a substitute for professional medical or mental-health care. In a personal-development skill, users may over-rely on self-help guidance and delay seeking appropriate support when symptoms reflect depression, anxiety, or other clinically significant conditions.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger table includes very broad phrases like "I'm drained", "Overwhelmed", and "No motivation" without clear boundaries tying activation to personal development planning tasks. In a shared assistant environment, such generic cues can cause the skill to activate outside its intended scope and steer responses toward this framework when the user may instead need another domain-specific response, creating prompt-routing and overreach risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This step instructs deletion of old directories after migration without requiring backup, verification, or explicit user confirmation. In a productivity skill that operates on a user's real home-directory content, this creates a credible risk of accidental data loss if files were mis-mapped, partially migrated, or still needed as references.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide says to delete old context files because the maintainer already handled them, but gives no caution about irreversibility or validation that the files are actually obsolete in the user's environment. If followed blindly, users or agents may remove customized files that still contain valuable information or local modifications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: These migration steps direct users to delete old files and directories after transferring content, but do not warn about data loss, partial merges, or rollback procedures. Because the skill concerns personal productivity data under ~/productivity/, mistakes can destroy notes, templates, or history that may not be recoverable.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs creating and updating files under `~/productivity/` and writing to `~/productivity/memory.md`, but it does not require a clear confirmation step immediately before filesystem modification or warn that local user data will be created/changed. In an agent setting, this can lead to unintended persistence, silent workspace pollution, or modification of sensitive local notes if the path already exists and contains user data.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.