prompt-engineer-toolkit

• Analyzed: May 11, 2026, 5:52 AM
• Findings: 1
• Version: 1.0.0
• Hash: 7c9b7e4f9946d328b1827e70a3c599bb620b33f02ba5eb4f2f56e5bbe34bfda6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The toolkit provides functional prompt engineering utilities, but `scripts/prompt_tester.py` contains a high-risk capability via the `--runner-cmd` parameter. This feature uses `subprocess.run` to execute arbitrary shell commands constructed from user-provided templates, which could be exploited for command injection or arbitrary code execution if the agent is manipulated into using a malicious runner or processing untrusted input. While this behavior is aligned with the tool's stated purpose of testing prompts against external CLIs, it represents a significant security risk without clear evidence of intentional malice.