RePrompter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:51 PM UTC
• Version: 7.0.0

Overview

This is a disclosed prompt-improvement and multi-agent orchestration skill, but users should review it because installation and team execution grant broad agent authority with some under-scoped safeguards.

Install only from a pinned release or reviewed commit, not the README main-branch curl command. Before enabling Repromptception, understand that it can spawn multiple agent sessions, write files under /tmp, read their outputs, retry work, and persist Claude Code team settings in your home configuration. Use explicit trigger phrases and review generated scopes before letting agents modify a project.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: README.md:403
• Finding: Mutable Remote Skill Archive Installed Without Integrity Verification## Vulnerability Details **File Location**: `README.md:403-406` **Vulnerability Type**: Unverified remote payload retrieval through a mutable branch archive **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p skills/reprompter curl -sL https://github.com/aytuncyildizli/reprompter/archive/main.tar.gz | \ tar xz --strip-components=1 -C skills/reprompter ``` ### Technical Analysis The documented installation command downloads an archive from the mutable `main` branch and extracts it directly into an active Skill directory. It does not pin a release tag or immutable commit and does not verify a checksum or cryptographic signature. The archive is not directly piped to a shell, so extraction alone does not immediately execute a native binary. However, the extracted files include Agent-readable Skill instructions and potentially executable scripts. Claude Code subsequently auto-discovers `skills/reprompter/SKILL.md`, meaning changed upstream content can become effective Agent instructions after installation without receiving the same review as the audited version. Use of HTTPS protects transport integrity but does not protect against compromise of the upstream account or repository, malicious upstream changes, or an unexpected force-push to the branch. ### Attack Path 1. An attacker compromises the upstream repository or maintainer account, or malicious content is committed to `main`. 2. The attacker modifies `SKILL.md`, a reference template, or an included script. 3. A user follows the documented installation command. 4. `curl` retrieves the current, attacker-controlled `main` archive. 5. `tar` extracts the unverified content directly into `skills/reprompter`. 6. Claude Code auto-discovers and loads the altered Skill. 7. Malicious instructions may then induce the Agent to invoke tools, disclose accessible information, modify files, or execute commands within the Agent's existing permissions. ### Impact Ass ...[truncated 567 chars]
• Remediation: ## Remediation Suggestions 1. Replace the mutable `main` archive with a versioned release or immutable commit archive. 2. Publish a SHA-256 checksum through an independently controlled release channel and verify it before extraction. 3. Download the archive to a temporary file rather than streaming it directly to `tar`. 4. List and validate archive entries before extraction, rejecting absolute paths, `..` traversal components, and unexpected files. 5. Extract into a newly created staging directory and move the validated contents into the final Skill directory. 6. Prefer signed release artifacts or signed Git tags where available. 7. Avoid `curl -s`, or use options such as `--fail --show-error --location` so HTTP and transport failures are visible. Example hardened pattern: ```bash set -euo pipefail version="v7.0.0" expected_sha256="PUBLISH_AND_INSERT_VERIFIED_CHECKSUM" archive="$(mktemp)" staging="$(mktemp -d)" curl --fail --show-error --location \ "https://github.com/aytuncyildizli/reprompter/archive/refs/tags/${version}.tar.gz" \ --output "$archive" printf '%s %s\n' "$expected_sha256" "$archive" | sha256sum --check - tar tzf "$archive" | grep -Ev '(^/|(^|/)\.\.(/|$))' >/dev/null tar xzf "$archive" --strip-components=1 -C "$staging" mkdir -p skills/reprompter cp -R "$staging"/. skills/reprompter/ rm -rf "$archive" "$staging" ```

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:198
• Finding: Predictable Agent Artifact Paths in Shared Temporary Directory## Vulnerability Details **File Location**: `SKILL.md:198-213` and `SKILL.md:245-247` **Vulnerability Type**: Unsafe predictable temporary-file handling **Risk Level**: Low ### Vulnerable Code ```markdown 4. **Write team brief** to `/tmp/rpt-brief-{taskname}.md` (use unique tasknames to avoid collisions between concurrent runs) ``` ```markdown - `<output_format>`: Exact path `/tmp/rpt-{taskname}-{agent-domain}.md`, required sections - `<success_criteria>`: Minimum N findings, file:line references, no hallucinated paths **Score each prompt — target 8+/10.** If under 8, add more context/constraints. Write all to `/tmp/rpt-agent-prompts-{taskname}.md` ``` ```bash # 5. Verify outputs ls -la /tmp/rpt-{taskname}-*.md ``` ### Technical Analysis The orchestration workflow places briefs, generated prompts, and Agent reports at predictable, task-name-derived paths under the globally shared `/tmp` directory. Requiring a “unique taskname” reduces accidental collisions but does not provide secure creation, ownership verification, exclusive access, or protection against symbolic links. On a multi-user host, another local process may predict or observe a task name and pre-create a matching regular file or symbolic link. Depending on how the Agent or tool opens the path, this can cause output replacement, report spoofing, unintended truncation, or writes to a different file accessible to the victim process. Reading results through a wildcard also does not verify that every matching file belongs to the current run. An attacker-created matching report could therefore be included in evaluation or synthesis. ### Attack Path 1. A local attacker predicts or observes the task name used by a Repromptception run. 2. The attacker creates files or symbolic links such as `/tmp/rpt-example-security.md` or `/tmp/rpt-agent-prompts-example.md`. 3. The victim starts the multi-agent workflow with the corresponding task name. 4. An A ...[truncated 849 chars]
• Remediation: ## Remediation Suggestions 1. Create one private directory per orchestration run with `mktemp -d`. 2. Set a restrictive umask and directory permissions, such as `umask 077` and mode `0700`. 3. Store every brief, prompt, report, and synthesis file inside that private directory. 4. Pass exact output paths to Agents instead of discovering outputs with a broad `/tmp` wildcard. 5. Before consuming an output, reject symbolic links and verify that the file is a regular file owned by the current user. 6. Use exclusive file creation where supported and fail if an expected output already exists. 7. Register cleanup with a shell trap and remove the private directory after completion. 8. If artifacts must be retained, move them to a user-owned project directory after validation rather than leaving them in shared temporary storage. Example orchestration setup: ```bash set -euo pipefail umask 077 RUN_DIR="$(mktemp -d "${TMPDIR:-/tmp}/reprompter.XXXXXXXX")" chmod 700 "$RUN_DIR" trap 'rm -rf -- "$RUN_DIR"' EXIT BRIEF="$RUN_DIR/team-brief.md" PROMPTS="$RUN_DIR/agent-prompts.md" SECURITY_REPORT="$RUN_DIR/security-report.md" FINAL_REPORT="$RUN_DIR/final-report.md" ``` Before reading an Agent result, validate it explicitly: ```bash if [[ -L "$SECURITY_REPORT" || ! -f "$SECURITY_REPORT" || ! -O "$SECURITY_REPORT" ]]; then echo "Invalid or untrusted Agent output" &gt;&amp;2 exit 1 fi ```

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Agent Config Directory Access

High

• Category: Agent Snooping

Content

<context>
- OpenClaw config: openclaw.json + .openclaw/ directory
- Claude Code settings: ~/.claude/settings.json (deny list, env vars)
- Safety rules in SOUL.md (8 hard rules — but are they mechanically enforced?)
- .gitignore recently expanded but may still miss sensitive paths
- Other agents: SecurityAuditor (#1), TokenCostAuditor (#2), MemoryBloatAuditor (#4)

• Confidence: 90% confidence
• Finding: The README explicitly instructs an auditing agent to inspect ~/.claude/settings.json, which may contain deny-list rules, environment variables, or other sensitive local configuration. In a skill context, directing access to user home configuration expands the trust boundary beyond project files and could expose secrets or security controls to the model and downstream outputs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about transforming prompts into structured prompts for agent workflows. The supplied code does something entirely different: it automates creation of GitHub Releases from a changelog and existing git tags. This is a materially different primary purpose and introduces undeclared repository/GitHub automation capabilities and resource access (git repo state, changelog file, GitHub CLI). There is no evident functionality related to prompt cleanup, XML/Markdown prompt generation, quality scoring, or multi-agent prompt creation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says the skill's purpose is prompt improvement and structuring for single- or multi-agent use. However, the supplied code chunk does not implement any prompt transformation, scoring, XML/Markdown generation, agent-team briefing, or execution logic related to reprompting. Instead, it performs release/package automation by zipping repository contents and excluding selected files. That is a materially different primary purpose and involves undeclared file packaging capabilities unrelated to the described skill behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says the skill actively rewrites/structures prompts and may generate team-oriented prompt artifacts. The actual code does none of that. Instead, it validates existing Markdown template files in a local directory by checking for required tags such as <role>, <context>, and <task>. This is a materially different primary purpose: repository template linting/validation rather than prompt transformation. The file-system access to docs/references is consistent with validation tooling, not with the described end-user prompt-cleanup behavior. Therefore this is a clear description-behavior mismatch.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

> Note: `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS` is an experimental flag that may change in future Claude Code versions. Check [Claude Code docs](https://docs.anthropic.com/en/docs/claude-code) for current status.

In `~/.claude/settings.json`:
```json
{
  "env": {

• Confidence: 90% confidence
• Finding: The skill instructs users to modify ~/.claude/settings.json, which touches a sensitive agent configuration location in the user's home directory. Although presented as setup guidance, encouraging access to and modification of global config can be risky because it may alter execution defaults across projects, enable experimental features broadly, and normalize interaction with privileged local configuration files.

Hidden Instructions

High

• Category: Prompt Injection

Content

</linearGradient>
  </defs>
  
  <!-- Icon: Terminal bracket with transform arrow -->
  <g transform="translate(10, 10)">
    <!-- Terminal window frame -->
    <rect x="0" y="0" width="100" height="100" rx="12" fill="#1a1b26" stroke="url(#grad1)" stroke-width="2.5"/>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<rect width="1280" height="640" fill="url(#bg)"/>
  
  <!-- Subtle grid pattern -->
  <g opacity="0.03">
    <line x1="0" y1="80" x2="1280" y2="80" stroke="#fff" stroke-width="1"/>
    <line x1="0" y1="160" x2="1280" y2="160" stroke="#fff" stroke-width="1"/>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

ening.

## Template

```xml
<role>
{Security engineer specializing in [detected framework/language] security, OWASP guidelines, and secure coding practices}
</role>

<context>
- Application: {framework and type}
- Scope: {what to audit/secure}
- Auth system: {authentication method}
- Data sensitivity: {type of data handled}
- Compliance: {GDPR, HIPAA, SOC2, etc. if applicable}
</context>

<threat_model>
Consider these threat vectors:
- {Threat 1}: {description}
- {Threat 2}: {description}
- {Threat 3}: {description}
</threat_model>

<task>
{Audit/implement/fix} security for {scope} focusing on {specific concerns}.
</task>

<motivation>
{Threat severity, compliance requirements, exposure window}
</motivation>

<requirements>
1. **Input validation**: {sanitization requirements}
2. **Authentication**: {auth requirements}
3. **Authorization**: {access control requirements}
4. **Data protection**: {encryption, masking, etc.}
</requirements>

<constraints>
- Follow OWASP Top 10 guidelines
-

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest positions this skill as transforming messy prompts into structured prompts, optionally for multi-agent use. However, the README says v7 'merges single-prompt and team orchestration into one skill' and later describes detecting complexity, selecting execution mode, running team workflows, evaluating outputs, and retrying agents, which expands from prompt authoring into workflow orchestration/execution.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

tar xz --strip-components=1 -C skills/reprompter
```

Claude Code auto-discovers `skills/reprompter/SKILL.md`.

### OpenClaw

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Overly broad trigger phrases can cause unintended invocation of team/orchestration behavior during ordinary requests, expanding scope and potentially increasing access to files, configs, or multi-agent workflows without clear user intent. In an agent environment, ambiguous activation raises the risk of surprise actions, excess context exposure, and unsafe task routing.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest outputs are structured prompts, quality scores, optional team briefs, per-agent sub-prompts, and agent team output files. In contrast, the README describes a '4-phase loop' of Team Plan → Repromptception → Execute → Evaluate+Retry and says the skill has 'closed-loop quality' with retries, which is materially broader than merely producing prompts and artifacts.

External Transmission

Medium

• Category: Data Exfiltration

Content

<p align="center">
  <a href="https://www.star-history.com/#AytuncYildizli/reprompter&Date">
    <img src="https://api.star-history.com/svg?repos=AytuncYildizli/reprompter&type=Date" alt="Star History Chart" width="600">
  </a>
</p>

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger phrases are very broad, including terms like 'audit', 'parallel work', and 'anything going to agent teams', which can cause the skill to activate in contexts the user did not clearly intend. In a security-sensitive environment, accidental invocation can route tasks into more powerful workflows, including filesystem inspection and tmux-based multi-agent execution guidance, increasing the chance of unintended actions or over-collection of context.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: Mixing exact trigger phrases with vague auto-activation language makes invocation scope unclear and can lead to accidental skill activation. While lower severity than direct exfiltration, this ambiguity is unsafe in agent systems because it weakens user control over when broader workflows engage.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The template hard-codes output paths under /tmp for team briefs and per-agent artifacts without requiring user confirmation, uniqueness safeguards, or overwrite protections. In an agent-execution context, this can cause unintended local file creation, collisions with existing files, or clobbering of prior artifacts, especially when task names are reused or attacker-influenced.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The note instructs execution to write a brief to disk and return the file path, but it does not warn about local side effects or specify safe file-creation behavior. Because this skill is meant to orchestrate multi-agent work and produce artifacts automatically, the omission increases the chance of silent writes, overwrites, or path misuse during execution.

Static analysis

No suspicious patterns detected.