Productivity Helper #1

• Outcome: Review
• Latest audit: May 29, 2026, 9:33 PM
• Version:
  1.0.0

Overview

This looks like a simple productivity helper, but it requests broad shell and file access without explaining why that power is needed.

Review before installing. The visible files do not show malicious behavior, but this planning helper asks for more local access than it explains. Install only if you are comfortable with the agent potentially running commands and reading or writing local files, and verify the external setup or GitHub instructions before following them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation guidance is extremely broad and maps to ordinary productivity requests like organizing tasks, planning a day, or tracking time. This creates a trigger-collision risk where the skill may activate for routine user intents without clear invocation boundaries, causing unintended tool-enabled behavior in common conversations.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The example phrase, "Help me plan my day with 5 tasks," is a natural everyday request that many users would make outside any intent to invoke this skill. Because the skill has Bash, Read, and Write available, vague trigger examples increase the chance of accidental activation of a tool-capable skill during normal conversation.

VirusTotal

66/66 vendors flagged this skill as clean.