ClawHub
Back to skill

Security audit

Ai Prompt Library

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it significantly overstates what it provides and includes under-disclosed local logging behavior.

Review this carefully before installing. It appears more like an incomplete or mispackaged local CLI helper than the promised system-prompt/model library, and it may retain prompt-related inputs in a local history file. Avoid passing sensitive prompts, proprietary text, or credentials to it unless the logging behavior is removed or clearly controlled.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The description suggests a library or collection of full augment/code/system prompts and models for specific AI tools such as Claude Code, Cursor, Devin AI, and others. The actual code is a Bash command-line assistant that returns short static prompt tips, templates, comparisons, safety notes, and a token cost estimate. It also creates a data directory and logs usage history locally, which is not reflected in the declared permissions. While the subject area is loosely related to prompts/AI tools, the primary purpose is materially different from the declared description, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The description promises a substantive capability: access to or provision of system prompts and models for multiple AI tools. The supplied code does not do that. It only offers a simple command dispatcher that prints help text, version/repository info, a ready status, and a TODO message for the main run path. There are no implemented features for fetching, listing, analyzing, or exposing prompts/models, and no evidence of Python/AI/Bolt functionality. This is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Documenting broad triggers like run, info, and status without scope, input constraints, or safety boundaries can cause an agent or user to invoke behavior too generally. In an agent-skill ecosystem, ambiguous command surfaces increase the chance of misuse, unexpected execution paths, or unsafe chaining with underlying tools.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The phrase 'Run any command: ai-prompt-library <command> [args]' advertises an unconstrained command surface with no allowlist or guardrails. In the context of an agent skill, this can encourage arbitrary command dispatch and makes the skill more dangerous because its declared interface does not limit what actions may be requested or passed through.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
## Usage

Run any command: `ai-prompt-library <command> [args]`
---
💬 Feedback & Feature Requests: https://bytesagain.com/feedback
Powered by BytesAgain | bytesagain.com

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline usage documentation says the command is 'Evaluate output', implying it maps to the evaluate functionality. In the command dispatcher, however, the evaluate case calls cmd_"$@" rather than cmd_evaluate, contradicting the documented behavior and potentially invoking an unintended function name derived from user input.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script logs user-supplied prompt inputs to a persistent history file without clear disclosure or consent. Because prompt inputs may contain sensitive data, system prompts, or proprietary content, this creates an unintended local data-retention channel that can expose information to other local users, backups, or later compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The evaluate dispatch uses cmd_"$@" after shifting arguments, which lets user-controlled input select an arbitrary shell function name for execution. In this script that enables invocation of internal helpers like _log and may cause unintended command execution paths or denial-of-service, and in shell contexts dynamic dispatch from untrusted input is especially risky.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script creates a persistent data directory and writes local files even though the skill is described primarily as a prompt/model library. This mismatch is dangerous because users may reasonably expect a read-only informational tool and may not anticipate filesystem side effects or retained artifacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.