Security audit

Goal Clarifier

Security checks across malware telemetry and agentic risk

Overview

This is a text-only goal-planning skill that uses provided progress context to tailor schedules and reviews, with no code execution, credential access, or destructive behavior.

Before installing, understand that this skill may use saved goal progress, weekly plans, and user notes supplied by the host to personalize advice. Avoid placing highly sensitive details in goal context unless needed, and review any generated weeklyPlan JSON before relying on it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The guide extends a benign clarification skill into ongoing workflow orchestration by instructing it to emit schedules and integration-oriented JSON. That broadens capability beyond the declared purpose and can cause unauthorized persistence, task steering, or hidden agent behavior if the surrounding platform treats these outputs as actionable state.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The hidden use of `[GOAL_CONTEXT]` and `[WEEKLY_CYCLE_REVIEW]` introduces non-obvious privileged context handling and system-triggered behavior that is not apparent from the public skill description. This is risky because the model is told to act on hidden state and avoid mentioning it, which can bypass user awareness and make the skill perform unintended tracking or nudging actions.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The guide explicitly instructs the skill to consume hidden system-provided structures such as `[GOAL_CONTEXT]` and `[WEEKLY_CYCLE_REVIEW]`, then use them to shape responses while concealing their existence from the user. That creates a data-bound behavior beyond plain conversational clarification and can lead to opaque use of internal state, privacy boundary confusion, and unintended action steering if the hidden context is stale, overly broad, or injected incorrectly.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The workflow materially expands from one-time goal clarification into recurring weekly scheduling, progress tracking, and phase-transition automation. That scope creep can cause the agent to act beyond the user’s original request and maintain an ongoing coaching loop without sufficiently explicit consent, increasing the chance of unwanted persistence and overreach.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: System-triggered weekly cycle handling is not well aligned with the stated purpose of gentle goal clarification and action planning. Allowing automated re-entry on a timer or system event can create unsolicited engagement and agent behavior that appears proactive without a fresh user request, which is risky in a conversational assistant context.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The workflow materially expands from one-time goal clarification into ongoing weekly scheduling, recurring reviews, and phase-based execution management. That broadens the skill into persistent coaching/workflow orchestration beyond its declared purpose, which can cause unauthorized scope creep, unexpected retention/use of user context, and reliance on the agent for continued behavioral management.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The automatic trigger on `[WEEKLY_CYCLE_REVIEW]` introduces system-initiated recurring engagement that is not necessary for basic goal clarification. This can create unanticipated re-engagement and agent-driven task management behavior, especially if users did not knowingly consent to ongoing check-ins or stateful planning cycles.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: Using `[GOAL_CONTEXT]`, `[ACTIVE_PHASE]`, and completion-rate tracking adds persistent state and progress management beyond a simple clarification interaction. In context this is not overtly malicious, but it increases privacy and behavioral influence risk because the skill can infer progress, steer phase transitions, and maintain longitudinal workflow state without clear boundaries.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation guidance is broad enough to match many ordinary requests, increasing the chance the skill is selected when a simpler or safer skill should handle the task. Over-broad routing can create unwanted multi-turn probing, collect unnecessary personal context, and interfere with user intent by shifting the interaction into clarification mode without clear need.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The dedicated trigger section repeats ambiguous phrases like 'help me think this through' and 'help me make a plan' without enough contextual constraints, which can cause accidental invocation in many benign conversations. In a multi-skill environment, this increases prompt-routing instability and may expose users to unnecessary questioning or hidden workflow behavior tied to this skill.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad, common expressions like '帮我理一理' and '我有很多想法', which can overlap with ordinary conversation and cause the skill to activate when the user did not intend to enter a structured planning flow. Mis-triggering can lead to unnecessary collection of personal context, conversational derailment, and unintended use of hidden progress data if the runtime wires this skill automatically.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The phrase that the AI 'naturally transitions' after roadmap confirmation is ambiguous and gives the model broad discretion to decide when to enter weekly scheduling. In practice, ambiguous transitions can cause the agent to infer consent too broadly, leading to unexpected collection of scheduling details or generation of plans the user did not explicitly ask for.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger 'User initiates review conversation manually' is too broad because many ordinary follow-up messages could be interpreted as a review request. This can make the agent pivot into progress analysis and next-week planning without a clear user instruction, causing mild but real scope overreach and confusion.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.