ClawHub
Back to skill

Security audit

Smart Prompt Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown prompt-template skill with broad but disclosed prompt-generation behavior and no artifact-backed evidence of credential theft, exfiltration, persistence, or code execution.

Reasonable to install if you want a prompt-template library. Treat generated prompts and downstream AI-generated code as drafts: review security-sensitive outputs such as authentication, payments, analytics, ads, and token handling before using them in production. The security claims in SECURITY.md are stronger than the visible Markdown-only implementation proves, so do not rely on them as a guarantee.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
Findings (22)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 27)May include surrounding context.

text
.nyc_output/

# Misc
.env
.env.local

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 28)May include surrounding context.

text
# Misc
.env
.env.local

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · CONTRIBUTORS.md (reported line 13)May include surrounding context.

md
## 🤝 Contributors

### Code Contributors
<!-- This will be automatically updated by GitHub Actions -->
None yet - be the first!

### Template Contributors

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SECURITY.md (reported line 69)May include surrounding context.

md
### Data Privacy

- ❌ **No data collection**: This skill doesn't send data to external servers
- ❌ **No tracking**: We don't track how you use generated prompts
- ✅ **Local processing**: All prompt generation happens locally
- ✅ **Your prompts are yours**: Generated prompts are not stored or shared

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SECURITY.md (reported line 114)May include surrounding context.

  • Include malicious code
  • Add obfuscated content
  • Submit untested templates
  • Bypass security reviews
text

## Known Security Issues

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/flutter_authentication.md (reported line 35)May include surrounding context.

md
- At least 1 uppercase letter
  - At least 1 number
  - At least 1 special character
- Token Storage: Use flutter_secure_storage for iOS Keychain and Android Keystore
- Session Timeout: 30 days, configurable
- Rate Limiting: Max 5 login attempts per 15 minutes

Unvalidated Output Injection

High
Category
Output Handling
Confidence
80% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · examples/flutter_authentication.md (reported line 230)May include surrounding context.

md
## 💡 Pro Tips

1. **Iterate**: Start with basic version, add complexity as needed
2. **Test Early**: Run generated code immediately to validate
3. **Customize**: Adjust generated code to match your style
4. **Save**: Keep successful prompts for future use
5. **Share**: Contribute successful prompts back to community

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance says to invoke the skill whenever a user asks for help creating a prompt, which is a broad trigger that can cause the skill to activate in many loosely related contexts. Overbroad activation can lead to unintended routing, prompt interference, or accidental exposure of this skill's behavior in situations where a more specific or safer skill should handle the request.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · PROJECT_SUMMARY.md (reported line 205)May include surrounding context.

Immediate Actions

  1. Create GitHub Repository
    bash
    # Go to https://github.com/new
# Name: skill-prompt-generator

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

Input:

text
Create a prompt for user authentication in my Flutter app

Output:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to activate the skill with a very broad phrase like 'Just ask for help creating a prompt,' which risks unintended invocation during normal conversation. In an agent ecosystem, overly generic activation guidance can cause this skill to trigger when the user did not explicitly intend to use it, increasing prompt-surface exposure and potentially interfering with routing to more appropriate skills.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 434)May include surrounding context.

md
Attempted:
- Reinstalled pods
- Cleaned build folder
- Checked permissions in Info.plist

Provide:
1. Root cause analysis

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This section makes concrete security guarantees such as sanitization, input validation, review, and local-only processing, but the SECURITY.md file itself does not provide evidence those controls actually exist or are enforced. Overstated security claims can mislead users into trusting generated prompts or handling sensitive data less cautiously, which increases risk if the implementation does not match the documentation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SECURITY.md (reported line 69)May include surrounding context.

md
### Data Privacy

- ❌ **No data collection**: This skill doesn't send data to external servers
- ❌ **No tracking**: We don't track how you use generated prompts
- ✅ **Local processing**: All prompt generation happens locally
- ✅ **Your prompts are yours**: Generated prompts are not stored or shared

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The architecture diagram asserts a 'sandboxed' template engine and labels output as 'safe to use', which are strong assurances that may not be true in practice. If these guarantees are inaccurate, users and reviewers may underestimate prompt-injection or unsafe-template risks and rely on nonexistent protections.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description is broad enough to match a large range of ordinary user requests such as help with writing, education, business, programming, and general prompt improvement. This can cause the skill to be invoked unnecessarily often, increasing its influence over unrelated conversations and expanding the attack surface for prompt injection or policy-bypassing behavior if the skill content is ever modified or abused.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · UPLOAD_GUIDE.md (reported line 67)May include surrounding context.

  1. الوصف: AI Prompt Generator skill for OpenClaw with Flutter templates
  2. نوعه: Public
  3. لا تضف README (لدينا واحد)
  4. اضغط "Create repository"
text

### 2️⃣ رفع الملفات

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · UPLOAD_GUIDE.md (reported line 67)May include surrounding context.

  1. lلوصف: AI Prompt Generator skill for OpenClaw with Flutter templates
  2. نوعo: Public
  3. لl تضف README (لدينl وlحد)
  4. lضغط "Create repository"
text

### 2️⃣ رفع lلملفlت

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README explicitly tells users to use AI-generated code as a starting point and customize it, but it does not pair that guidance with a clear requirement to review, test, and security-audit the output before use. In a prompt-generation skill that may produce implementation guidance for authentication, game logic, and other code, this can normalize unsafe trust in generated code and increase the chance that insecure or incorrect code is adopted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The monetization template explicitly includes analytics, ad integration, and purchase flows, but provides no prompt guidance to surface privacy, consent, tracking, retention, or child-safety disclosures. Because this skill is a prompt generator, omissions in the template can propagate into downstream app designs that collect user data or use ad SDKs without adequate user-facing warnings or compliance considerations, especially for mobile games aimed at broad audiences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file presents all operational instructions exclusively in Arabic and does not indicate that the language is optional, user-selectable, or justified by a regional requirement. Under the policy rule for language/locale constraints, that can be considered a natural-language policy issue because it implicitly forces one language for users of the skill documentation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest description presents the skill as a general-purpose "Comprehensive AI Prompt Generator" for multiple domains, but it does not define when the skill should activate or what requests it should and should not handle. For manifest files, this lack of trigger specificity can contribute to overly broad invocation behavior if the host uses description text for routing.

Content

No source excerpt is available for this finding.