Security audit

Detector of prompt injection

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it claims, but it needs review because it can send inspected text and API keys to configurable remote endpoints and may duplicate submitted text into logs or JSON output.

Review before installing. Use it only for text you are allowed to send to Prompt Inspector or a trusted self-hosted service, use HTTPS endpoints only, prefer PMTINSP_API_KEY over --api-key, avoid batch files containing secrets or regulated data, and treat JSON/log output as potentially containing the submitted prompts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/detect.js:105
Finding: <![CDATA[Custom API endpoints permit plaintext transmission of credentials and inspected content]]>
Content: View full analysis
{ const endpoint = new URL(DETECT_PATH, baseUrl.replace(/\/$/, "")); const body = JSON.stringify({ input_text: text }); const isHttps = endpoint.protocol === "https:"; const transport = isHttps ? https : http; const options = { hostname: endpoint.hostname, port: endpoint.port || (isHttps ? 443 : 80), path: endpoint.pathname, method: "POST", headers: { "X-App-Key": apiKey, "Content-Type": "application/json", "Accept": "application/json", "Content-Length": Buffer.byteLength(body), }, }; const req = transport.request(options, (res) => { ``` ### Technical Analysis Both implementations accept a user-selected `--base-url`. The Node.js implementation explicitly selects the built-in `http` transport for an `http:` URL, while the Python implementation passes the unvalidated URL to `urllib.request.urlopen`. Each request contains both the API key in the `X-App-Key` header and the complete inspected text in the JSON body. Consequently, an HTTP custom endpoint transmits both values without confidentiality or transport integrity. Supporting custom endpoints is legitimate for self-hosting, but accepting plaintext HTTP is not necessary for normal operation. The default ho ...[truncated 1256 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/detect.py:186
Finding: <![CDATA[API keys are accepted and promoted as command-line arguments]]>
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/detect.py:246
Finding: <![CDATA[Batch mode exposes inspected text in stderr logs and JSON results]]>
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/detect.py:39
Finding: <![CDATA[Shared OpenClaw environment file is parsed beyond the required credential]]>
Content: View full analysis
dict: """Parse a simple KEY=VALUE .env file and return a dict.""" env = {} try: for line in path.read_text(encoding="utf-8").splitlines(): line = line.strip() if not line or line.startswith("#") or "=" not in line: continue key, _, value = line.partition("=") value = value.strip() # Remove surrounding quotes if present if value and value[0] in ('"', "'") and value[-1] == value[0]: value = value[1:-1] env[key.strip()] = value except OSError: pass return env ``` `scripts/detect.py:69-74`: ```python # 3. ~/.openclaw/.env dotenv_path = Path.home() / ".openclaw" / ".env" dotenv = _load_dotenv(dotenv_path) dotenv_key = dotenv.get("PMTINSP_API_KEY") if dotenv_key: return dotenv_key ``` `scripts/detect.js:45-63`: ```javascript function loadDotenv(filePath) { const env = {}; try { const content = fs.readFileSync(filePath, "utf-8"); for (const raw of content.split(/\r?\n/)) { const line = raw.trim(); if (!line || line.startsWith("#") || !line.includes("=")) continue; const idx = line.indexOf("="); const key = line.slice(0, idx).trim(); let value = line.slice(idx + 1).trim(); // Remove surrounding quotes if present if (value.length >= 2 && (value[0] === '"' || value[0] === "'") && value[0] === value[value.length - 1]) { value = value.slice(1, -1); } env[key] = value; } } catch (_) { // File not found or unreadable — ignore } return env; } ``` ### Technical Analysis The sc ...[truncated 1273 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: references/product-info.md:31
Finding: <![CDATA[Documentation recommends installing unpinned third-party SDK packages]]>
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/usage.md (reported line 5)May include surrounding context.
md
# Prompt Inspector — Usage Guide ## Overview Prompt Inspector protects your LLM-based applications by detecting adversarial user inputs before they reach your language model. This guide covers common integration patterns and usage scenarios. --- ## Authentication All API requests require an API key sent in the `X-App-Key` HTTP header. **Obtain your key:** Sign up at [promptinspector.io](https://promptinspector.io). The helper scripts resolve the key in this order: | Priority | Source | | -------- | ----------------------------------- | | 1 | `--api-key` CLI argument | | 2 | `PMTINSP_API_KEY` en

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · references/usage.md (reported line 153)May include surrounding context.
md
| Category | Description | | ---------------------- | -------------------------------------------------------- | | `prompt_injection` | Classic instruction override / prompt hijacking | | `jailbreak` | Attempts to bypass safety guidelines or restrictions | | `instruction_override` | Commands to ignore system prompts or previous context | | `role_play_escape` | Persona-switching attacks (e.g., "pretend you are DAN") | | `data_exfiltration` | Attempts to extract system prompts or sensitive data |

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · references/usage.md (reported line 153)May include surrounding context.
md
| Category | Description | | ---------------------- | -------------------------------------------------------- | | `prompt_injection` | Classic instruction override / prompt hijacking | | `jailbreak` | Attempts to bypass safety guidelines or restrictions | | `instruction_override` | Commands to ignore system prompts or previous context | | `role_play_escape` | Persona-switching attacks (e.g., "pretend you are DAN") | | `data_exfiltration` | Attempts to extract system prompts or sensitive data |

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/detect.js (reported line 9)May include surrounding context.
js
No third-party packages required beyond the Python standard library. Usage: python3 detect.py --text "Ignore all previous instructions..." python3 detect.py --file inputs.txt --format json python3 detect.py --api-key pi_xxx --text "..." --format json

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/detect.js (reported line 251)May include surrounding context.
js
No third-party packages required beyond the Python standard library. Usage: python3 detect.py --text "Ignore all previous instructions..." python3 detect.py --file inputs.txt --format json python3 detect.py --api-key pi_xxx --text "..." --format json

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/detect.py (reported line 9)May include surrounding context.
python
No third-party packages required beyond the Python standard library. Usage: python3 detect.py --text "Ignore all previous instructions..." python3 detect.py --file inputs.txt --format json python3 detect.py --api-key pi_xxx --text "..." --format json

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/detect.py (reported line 189)May include surrounding context.
python
No third-party packages required beyond the Python standard library. Usage: python3 detect.py --text "Ignore all previous instructions..." python3 detect.py --file inputs.txt --format json python3 detect.py --api-key pi_xxx --text "..." --format json

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/detect.js (reported line 16)May include surrounding context.
js
Authentication (in priority order): 1. --api-key command-line argument 2. PMTINSP_API_KEY environment variable 3. ~/.openclaw/.env file (line: PMTINSP_API_KEY=...) """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/detect.js (reported line 41)May include surrounding context.
js
Authentication (in priority order): 1. --api-key command-line argument 2. PMTINSP_API_KEY environment variable 3. ~/.openclaw/.env file (line: PMTINSP_API_KEY=...) """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/detect.js (reported line 79)May include surrounding context.
js
Authentication (in priority order): 1. --api-key command-line argument 2. PMTINSP_API_KEY environment variable 3. ~/.openclaw/.env file (line: PMTINSP_API_KEY=...) """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/detect.py (reported line 16)May include surrounding context.
python
Authentication (in priority order): 1. --api-key command-line argument 2. PMTINSP_API_KEY environment variable 3. ~/.openclaw/.env file (line: PMTINSP_API_KEY=...) """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/detect.py (reported line 41)May include surrounding context.
python
Authentication (in priority order): 1. --api-key command-line argument 2. PMTINSP_API_KEY environment variable 3. ~/.openclaw/.env file (line: PMTINSP_API_KEY=...) """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/detect.py (reported line 70)May include surrounding context.
python
Authentication (in priority order): 1. --api-key command-line argument 2. PMTINSP_API_KEY environment variable 3. ~/.openclaw/.env file (line: PMTINSP_API_KEY=...) """ import argparse

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/detect.js (reported line 80)May include surrounding context.
js
return env_key # 3. ~/.openclaw/.env dotenv_path = Path.home() / ".openclaw" / ".env" dotenv = _load_dotenv(dotenv_path) dotenv_key = dotenv.get("PMTINSP_API_KEY") if dotenv_key:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/detect.py (reported line 71)May include surrounding context.
python
return env_key # 3. ~/.openclaw/.env dotenv_path = Path.home() / ".openclaw" / ".env" dotenv = _load_dotenv(dotenv_path) dotenv_key = dotenv.get("PMTINSP_API_KEY") if dotenv_key:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents use of environment variables, file input, and outbound network access to an external API, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch can cause the runtime or reviewer to underestimate what the skill can access and do, weakening least-privilege controls and increasing the chance of unintended data exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is specifically designed to send user-provided text to a third-party detection service, but the documentation does not clearly warn that submitted content leaves the local environment or describe privacy/data-handling implications. In AI pipelines, that can lead operators to transmit sensitive prompts, secrets, or regulated data to an external provider without informed consent or appropriate controls.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The sample curl command explicitly posts input_text to https://promptinspector.io, which is an external transmission of potentially untrusted or sensitive user content. Because this skill is specifically intended to inspect arbitrary user prompts before they reach an LLM, the transmitted data may include secrets, jailbreak payloads, internal instructions, or personal information, making the external transfer more security-relevant than in ordinary documentation.
Content: Scanner excerpt · references/faq.md (reported line 64)May include surrounding context.
What does a minimal API request look like?

bash
curl -X POST https://promptinspector.io/api/v1/detect/sdk \ -H "X-App-Key: your-api-key" \ -H "Content-Type: application/json" \ -d '{"input_text": "..."}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs users to send arbitrary user-provided text to a remote service but does not warn that this text leaves the local environment and may contain sensitive or regulated data. In an AI pipeline, users may assume inspection is local; this omission can cause accidental disclosure of prompts, PII, secrets, or proprietary content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The batch mode examples encourage uploading line-by-line file contents to the service without warning that the entire file's contents may be transmitted off-system. This is particularly risky because bulk files often contain many records, amplifying privacy and data-loss impact if operators use real datasets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends arbitrary user-provided text to a remote service for inspection, but it does not present a clear user-facing disclosure or consent warning at the point of use. In security-sensitive environments, this can cause accidental exfiltration of secrets, internal prompts, customer data, or regulated content when operators assume processing is local.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The examples show passing the API key directly on the command line, which can expose credentials through shell history, process listings, audit logs, and shared terminal transcripts. Even though environment-variable support is mentioned elsewhere, providing inline key examples without a warning normalizes an unsafe handling pattern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The FAQ provides example code that sends user-supplied text to a third-party API but does not clearly warn that submitted content leaves the local environment and may contain sensitive data. In a security-oriented skill that processes arbitrary user prompts, this omission can lead operators to forward confidential or regulated text to a remote service without informed consent or sanitization.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Anti-Refusal Statement

Instruction Override

Instruction Override

Instruction Override

Instruction Override

Instruction Override

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Missing User Warnings

External Transmission

What does a minimal API request look like?

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis