AOI Prompt Injection Sentinel

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:24 PM UTC
• Version: 0.1.2

Overview

This skill is a local prompt-injection text scanner whose flagged strings are detector rules, not instructions it tries to make the agent follow.

This appears safe to install for local prompt-injection screening. Treat it as a simple heuristic scanner, not a complete security product, and avoid feeding highly sensitive text unless you are comfortable with a local JSON result that includes a deterministic hash of the input.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Instruction Override

High

• Category: Prompt Injection

Content

severity: Severity.HIGH,
    action: Action.BLOCK,
    re: /\b(ignore|disregard|override)\b\s+(the\s+)?(system|developer)\s+(prompt|instructions)/i,
    reason: 'Attempt to override system/developer instructions',
  },
  {
    id: 'R2_SECRET_EXFIL',

• Confidence: 90% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

EXEC',
    severity: Severity.MED,
    action: Action.WARN,
    re: /\b(rm\s+-rf|curl\s+http|wget\s+http|chmod\s+\+x|bash\s+-c|powershell)\b/i,
    reason: 'Shell execution / download instruction pattern',
  },
  {
    id: 'R5_SOCIAL_ENGINEERING',
    severity: Severity.MED,
    action: Action.WARN,
    re: /\b(you already approved|keep going|do the rest|no need to ask|trust me)\b/i,
    reason: 'Social-engineering style escalation attempt',
  },
];

function fingerprint(text) {
  return crypto.createHash('sha256').update(text, 'utf8').digest('hex');
}

function parseArgs(argv) {
  const [cmd, ...rest] = argv;
  const args = {};
  for (const r of rest) {
    if (r.startsWith('--')) {
      const [k, v = 'true'] = r.slice(2).split('=');
      args[k] = v;
    }
  }
  return { cmd, args };
}

async function readStdin() {
  return new Promise((resolve) => {
    let data = '';
    process.stdin.setEncoding('utf8');
    process.stdin.on('data', (c) => (data += c));
    process.stdin.on('end

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Static analysis

No suspicious patterns detected.