Ro Prompt Optimizer

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:24 AM UTC
• Version: 1.0.0

Overview

This is a coherent Chinese prompt-optimization skill with optional local export behavior, and I found no evidence of malicious or deceptive behavior.

Install this if you want a Chinese-language R-O prompt optimizer. Avoid using the optional save or clipboard choices with secrets, credentials, private business data, or regulated content unless you are comfortable leaving that prompt text on disk or in the system clipboard.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a material mismatch between the declared behavior (prompt optimization) and the reported implementation behavior (local file writes, clipboard access, and interactive export flows). This is dangerous because reviewers and users may grant trust based on the description while the skill performs extra side effects that can expose sensitive prompt content, overwrite local files, or place data on the system clipboard where other apps may read it. Hidden capability expansion is a common path to data leakage and unsafe execution.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/auto-optimizer.py (reported line 330)May include surrounding context.

python

- 确保输出符合所有维度的要求
- 如有不确定的地方，请先澄清再继续"""
        
        return prompt
    
    def optimize(self, request: str) -> ROOptimization:
        """执行完整的R-O优化"""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill metadata declares no tool scope or permissions, yet the referenced implementation reportedly has file write capability. Undeclared write access weakens user consent and reviewability, and could allow prompts or outputs to be saved locally without clear authorization. In a prompt-optimization skill, that capability is not obviously necessary from the visible spec, which makes the mismatch more concerning.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill whenever a user needs to optimize prompts, improve AI interaction effects, or create more effective instructions. These conditions are broad and lack specific trigger phrases, boundaries, or exclusion cases, which could cause unintended invocation for many ordinary AI-assistance requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The entire skill description and examples are written only in Chinese, and the examples assume Chinese-context outputs without stating that language is optional or user-selected. This can constitute a language/locale policy issue if the skill effectively forces a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Criteria such as 'when the user provides a vague or simple request' and 'when needing to improve AI reply quality' are highly generic and overlap with a wide range of normal conversations. The section does not include negative examples or constraints distinguishing this skill from general-purpose assistance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file is entirely in Chinese and provides no language-selection or opt-in mechanism, which can exclude or confuse users who do not read Chinese. In a prompt-optimization skill, this can cause users to misunderstand examples and produce incorrect prompts, but it does not create a code-execution or data-exfiltration path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains natural-language instructions and templates exclusively in Chinese, but it does not indicate that the skill is region-specific or provide users with an option to use another language. Under the policy rule for language or locale constraints, forcing a single language without user opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The title and all instructional content are written entirely in Chinese, with no indication that other languages are supported or that the Chinese-only format is required for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description is entirely in Chinese and presents the skill as a Chinese prompt optimizer, while the interactive CLI prompts and generated output are also hard-coded in Chinese. There is no indication that users can choose another language or that the Chinese-only behavior is required for a region-specific or compliance reason.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill’s stated purpose is prompt optimization, but the CLI also stores full user content to local files and offers clipboard export. If users paste sensitive prompts, credentials, proprietary text, or regulated data, the tool can unintentionally persist or expose that data outside the immediate session, increasing confidentiality risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Local file writing and clipboard access broaden the skill’s capabilities beyond its declared function and create unnecessary data exposure channels. Clipboard contents may be readable by other local applications, and saved files may remain on disk long after the user expects the prompt to be transient.

Content

No source excerpt is available for this finding.

Tainted flow: 'filename' from input (line 453, user input) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/auto-optimizer.py (reported line 449)May include surrounding context.

python

if choice == "1":
                filename = f"ro_optimized_{hash(user_input) % 10000}.md"
                with open(filename, 'w', encoding='utf-8') as f:
                    f.write(formatted_output)
                print(f"✅ 已保存为: {filename}")
            elif choice == "2":

Tainted flow: 'filename' from input (line 453, user input) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/auto-optimizer.py (reported line 454)May include surrounding context.

python

if choice == "1":
                filename = f"ro_optimized_{hash(user_input) % 10000}.md"
                with open(filename, 'w', encoding='utf-8') as f:
                    f.write(formatted_output)
                print(f"✅ 已保存为: {filename}")
            elif choice == "2":

Static analysis

No suspicious patterns detected.