Productivity Helper #3

• Outcome: Review
• Latest audit: May 29, 2026, 9:33 PM
• Version:
  1.0.0

Overview

This is a simple productivity-planning skill, but it requests broad shell and file access without clear limits.

Install only if you are comfortable with a general productivity skill being able to run shell commands and read or write local files. Require explicit approval before any command or file change, and independently verify the external setup link or GitHub clone instructions before using them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The skill advertises activation for broad, everyday productivity requests like organizing tasks, planning a day, and reviewing progress. Because these are common conversational intents rather than a narrow, distinctive trigger domain, the skill can be invoked unexpectedly and capture routine user interactions, expanding tool exposure beyond what users likely intend.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The example prompt, "Help me plan my day with 5 tasks," is indistinguishable from an ordinary user request and therefore trains or signals activation on generic conversation. This increases the chance of accidental routing to a tool-enabled skill, which is especially relevant because the skill is allowed to use Bash and Write in addition to Read.

VirusTotal

65/65 vendors flagged this skill as clean.