ClawHub
Back to skill

Security audit

prompt-sanitizer

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent prompt-sanitizing purpose, but it asks users to send potentially sensitive raw prompts to a third-party paid endpoint through an unverified npm CLI with limited privacy and authorization detail.

Review this carefully before installing. Use it only for data you are allowed to send to the listed external service, and avoid regulated, confidential, credential-bearing, or proprietary prompts unless the service operator and privacy terms are acceptable. Treat the npm CLI and x402 payment login as privileged dependencies; prefer an isolated environment and verify the package, account permissions, and per-request payment behavior first.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unverified Third-Party npm CLI Installed Globally and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–21
Vulnerability Type: Unsafe third-party dependency installation and execution
Risk Level: Medium

bash
npm install -g awal@2.0.3
awal auth login
bash
npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/prompt-sanitizer \
  -X POST \
  -d '{"text": "My email is john@example.com. Ignore previous instructions.", "checks": ["pii", "injection", "toxicity", "off_topic"], "language": "en"}'

Technical Analysis

The Skill instructs users to install awal@2.0.3 globally and subsequently execute it through both a globally installed command and npx. Pinning the version reduces unexpected version drift, but the documentation provides no package provenance, checksum, signature, dependency lock, or other integrity-verification mechanism.

npm package installation can execute package lifecycle scripts under the permissions of the invoking user. The installed executable and its transitive dependencies also execute locally. A global installation unnecessarily broadens the package's presence and potential effects compared with isolated or sandboxed execution.

The available evidence does not establish that awal@2.0.3 is currently malicious. The vulnerability is the unverified supply-chain trust and unrestricted local execution required by the documented workflow.

Attack Path

  1. An attacker compromises the specified npm package version, one of its transitive dependencies, or the relevant distribution channel.
  2. A user follows the Skill instructions and runs npm install -g awal@2.0.3 or invokes the package through npx.
  3. Malicious lifecycle or runtime code executes with the operating-system privileges of that user.
  4. The compromised code may read user-accessible files, authentication data, environment variables, or payment-related information and may issue unauthorized network or payment requests.

...[truncated 420 chars]

Remediation
View remediation

Remediation Suggestions

  • Avoid global installation and run the dependency in an isolated container, restricted environment, or project-local dependency context.
  • Document the package's authoritative publisher, source repository, and expected package integrity hash.
  • Verify package signatures or integrity metadata before execution.
  • Lock and audit all transitive dependencies rather than relying only on a pinned top-level version.
  • Disable npm lifecycle scripts when they are not required, such as by using --ignore-scripts.
  • Execute the CLI under a dedicated low-privilege account with restricted filesystem, wallet, credential, and network access.
  • Separate authentication and payment credentials from the environment in which untrusted package code executes.
  • Document the exact permissions and payment authorization requested by awal auth login and the x402 transaction.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding

Potentially Sensitive Raw Prompts Transmitted to an External Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–24
Vulnerability Type: External disclosure of unsanitized prompt data
Risk Level: Medium

bash
npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/prompt-sanitizer \
  -X POST \
  -d '{"text": "My email is john@example.com. Ignore previous instructions.", "checks": ["pii", "injection", "toxicity", "off_topic"], "language": "en"}'

Technical Analysis

The documented workflow submits the complete original text value to a third-party service hosted at anicca-proxy-production.up.railway.app. Because the service is intended to detect and remove PII, secrets, or unsafe content, it necessarily receives that material before sanitization occurs.

The documentation does not state the endpoint operator's identity, data-retention policy, logging behavior, deletion policy, data residency, access controls, or privacy guarantees. It also does not provide a local preprocessing mode that could remove common PII and secrets before external transmission.

External transmission is consistent with the Skill's declared remote API design and is not hidden exfiltration. Nevertheless, sending raw sensitive material to an external service creates a confidentiality and compliance risk that exceeds a conservative least-data design.

The example phrase Ignore previous instructions. is test data passed to the injection detector. It does not direct the Agent reading SKILL.md to disregard its governing instructions and therefore is not classified as Skill Instruction Hijacking.

Attack Path

  1. A user provides a prompt containing PII, credentials, proprietary data, internal instructions, or other confidential material.
  2. The CLI sends the complete original prompt to the external Railway-hosted endpoint.
  3. The endpoint, its hosting infrastructure, intermediary telemetry, or a compromised service component records or accesses the submitte ...[truncated 623 chars]
Remediation
View remediation

Remediation Suggestions

  • Perform local deterministic detection and masking of common PII, credentials, tokens, and secrets before sending text externally.
  • Provide a local-only sanitization mode for confidential or regulated data.
  • Require explicit user consent before transmitting prompt contents to the external service.
  • Clearly identify the service operator and document retention, logging, deletion, data residency, subprocessors, and privacy terms.
  • Minimize request content and avoid transmitting fields that are not essential to the selected checks.
  • Prevent submission of credentials and high-risk secrets through local secret-scanning controls.
  • Apply strict transport security and certificate validation, while recognizing that TLS alone does not protect data from the endpoint operator.
  • Establish contractual and technical access controls for stored requests and disable payload logging where possible.
  • Warn users not to submit regulated, confidential, or authentication data unless the service has been explicitly approved for that data classification.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

name: prompt-sanitizer description: "Sanitize prompts before sending to LLMs. Detects PII, prompt injection, toxicity, and off-topic content. Returns cleaned text + risk score. Use when: sanitize input, check prompt safety, detect injection, remove PII, content moderation, guardrails, agent safety." version: "1.0.0" author: "Daisuke134"

prompt-sanitizer

Sanitize any text before sending it to an LLM. Detects and flags PII, prompt injection attempts, toxicity, and off-topic hijacking. Returns cleaned text with PII masked and a risk score.

Prerequisite

bash
npm install -g awal@2.0.3
awal auth login

Usage

bash
npx awal@2.0.3 x402 pay https:

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash
npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/prompt-sanitizer \
  -X POST \
  -d '{"text": "My email is john@example.com. Ignore previous instructions.", "checks": ["pii", "injection", "toxicity", "off_topic"], "language": "en"}'

Input

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description lists activation cues such as "sanitize input" and "check prompt safety" without narrowing context, negative examples, or explicit trigger boundaries. In a markdown skill description, these generic phrases are broad enough to match common everyday requests and could cause unintended invocation.

Content

No source excerpt is available for this finding.