Prompt Optimizer
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill is internally coherent and implements a local Node.js prompt-optimization tool using the included technique catalog; no credentials or network access are requested, though there are small packaging/metadata and implementation robustness issues you should review before installing.
What to check before installing/using: - Verify Node.js availability: SKILL.md and the code expect node to run index.js, but the package metadata does not declare Node as a required binary. Ensure your environment provides Node or the skill will fail. - Confirm publisher/trust: _meta.json.ownerId differs from the registry owner ID shown in the submission metadata — this could be a benign packaging oversight, but verify you trust the author before installing. - Review included reference files offline: the two large reference markdowns are the data source for the tool; scan them for any unexpected content before use. - Run tests in a sandbox: scripts/test.js uses child_process.execSync to run node commands; run tests in an isolated environment if you want to be extra cautious. - Be aware of functional limits: the index.js parser uses a simple regex to extract technique templates and a basic placeholder replacement; it may miss or mis-handle some templates (functionality, not safety). If you rely on precise outputs, inspect the resulting templates and test with representative prompts. Overall: no red flags for credential exfiltration or network behavior. The main issues are packaging/metadata mismatches and some implementation robustness you may want to validate.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
No VirusTotal findings