Security audit

Productivity Master

Security checks across malware telemetry and agentic risk

Overview

This is a productivity-coaching skill that returns static time-management advice and does not request sensitive access or perform hidden actions.

This appears safe to install for Chinese-language productivity coaching. Be aware that it may activate for broad productivity-related prompts and may answer in Chinese by default; also note the minor metadata mismatch if publisher provenance matters to you.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger description is very broad, covering common topics like productivity, time management, focus, and procrastination. In a skill-routing system, this can cause over-triggering and inappropriate activation, which may suppress more suitable skills or alter user experience unexpectedly, though it does not directly create code execution or data exfiltration risk.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The description and content indicate Chinese-language behavior as the default without giving the user a choice or documenting a requirement for this restriction. This can cause unwanted language switching, misalignment with user expectations, and prompt-routing interference in multilingual environments, but it is primarily a quality and safety-of-operation issue rather than a severe security flaw.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.