Security audit

Prompt Diet

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local prompt-file token auditor with a user-approved cleanup workflow, and its sensitive actions are disclosed and proportionate.

Installers should understand that this skill may inspect sensitive workspace prompt, user, tool, and memory Markdown files, and should only run it against intended directories. Do not approve edits until reviewing the proposed changes, especially for MEMORY.md and tool-related files, and prefer a pinned or isolated tiktoken install if exact token counts are needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: scripts/token_count.py:252
Finding: Unpinned Third-Party Dependency Installation Recommendation
Content: View full analysis
Remediation: View remediation
``` 2. Generate and enforce cryptographic hashes: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Include hashes for every transitive dependency or use a lockfile generated by a trusted dependency-management tool. 4. Recommend installation inside a dedicated virtual environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Pin the package index to an approved source and avoid untrusted additional indexes. 6. Consider removing the installation recommendation entirely. The script already has a functional `chars/4` fallback, so the optional dependency is not necessary for basic operation. 7. Periodically review and deliberately update the pinned version and hashes after checking release provenance and known vulnerabilities. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code accurately supports part of the description: auditing token usage of the named workspace files. It reads those files, counts tokens, and can break counts down by section. However, the declared purpose prominently includes optimizing/compressing workspace files and prompt hygiene actions, especially safe compression to reduce token usage. This code does not compress, rewrite, optimize, or otherwise modify any files; it is strictly a reporting/counting tool. That is a material mismatch in primary capability, even though the auditing subset is correctly represented.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When given a directory that does not contain the expected OpenClaw workspace files, the script silently falls back to processing every .md file in that directory. In a prompt-analysis skill, this can cause unintended ingestion and reporting on unrelated Markdown documents, which may expose sensitive content or broaden the tool's scope beyond what the user expects.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The docstring frames directory resolution around returning Markdown paths for workspace scanning, but the actual behavior includes a broader fallback to every .md file in the directory. This is not just omitted detail: it changes the operational scope from specific workspace-file analysis to generic Markdown discovery.
Content: No source excerpt is available for this finding.