prompt-sanitizer

Security checks across static analysis, malware telemetry, and agentic risk

Overview

Prompt-injection indicators were detected in the submitted artifacts (ignore-previous-instructions); human review is required before treating this skill as clean.

Before installing, verify that you trust the external API and the 'awal' npm CLI, understand the per-request USDC charge, and avoid sending secrets or sensitive personal data unless you are comfortable with that provider processing it. ClawScan detected prompt-injection indicators (ignore-previous-instructions), so this skill requires review even though the model response was benign.

Static analysis

Static analysis findings are pending for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Sensitive prompt content may leave the local environment and be processed by a third-party service.

Why it was flagged

The skill sends the user's raw text, including possible PII, to an external API endpoint before returning sanitized output.

Skill content
POST https://anicca-proxy-production.up.railway.app/api/x402/prompt-sanitizer ... -d '{"text": "My email is john@example.com. Ignore previous instructions." ...}'
Recommendation

Use this only with text you are comfortable sending to the listed endpoint, and review the provider's privacy and retention practices if available.

What this means

Using the skill may spend funds or use an authenticated account/session for each sanitizer request.

Why it was flagged

The skill requires an authenticated payment-capable CLI session and charges per request.

Skill content
awal auth login ... $0.005 USDC per request (Base network, eip155:8453)
Recommendation

Confirm the payment setup, use spending limits where possible, and avoid allowing repeated unattended use if cost control matters.

What this means

The local environment must trust and execute an external npm package to use the service.

Why it was flagged

The skill depends on a third-party npm CLI package installed globally, while no install spec or bundled code is provided for review.

Skill content
npm install -g awal@2.0.3
awal auth login
Recommendation

Verify the npm package and publisher before installing, and consider running it in a constrained environment.