Credential Access
High
- Category
- Privilege Escalation
- Content
.nyc_output/ # Misc .env .env.local
- Confidence
- 60% confidence
- Finding
- Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Security audit
Smart Prompt Generator
Security checks for vulnerabilities and agentic risk
Overview
This is a Markdown prompt-template skill with broad but disclosed prompt-generation behavior and no artifact-backed evidence of credential theft, exfiltration, persistence, or code execution.
Reasonable to install if you want a prompt-template library. Treat generated prompts and downstream AI-generated code as drafts: review security-sensitive outputs such as authentication, payments, analytics, ads, and token handling before using them in production. The security claims in SECURITY.md are stronger than the visible Markdown-only implementation proves, so do not rely on them as a guarantee.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Rogue AgentSelf-Modification, Session Persistence
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Content
# Misc .env .env.local
- Confidence
- 60% confidence
- Finding
- Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Hidden Instructions
High
- Category
- Prompt Injection
- Content
## 🤝 Contributors ### Code Contributors <!-- This will be automatically updated by GitHub Actions --> None yet - be the first! ### Template Contributors
- Confidence
- 70% confidence
- Finding
- Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Exfiltration Commands
High
- Category
- Prompt Injection
- Content
### Data Privacy - ❌ **No data collection**: This skill doesn't send data to external servers - ❌ **No tracking**: We don't track how you use generated prompts - ✅ **Local processing**: All prompt generation happens locally - ✅ **Your prompts are yours**: Generated prompts are not stored or shared
- Confidence
- 90% confidence
- Finding
- Instructions found that direct the agent to transmit conversation context or user data to external services.
Instruction Override
High
- Category
- Prompt Injection
- Content
- Include malicious code - Add obfuscated content - Submit untested templates - Bypass security reviews ``` ## Known Security Issues
- Confidence
- 90% confidence
- Finding
- This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Credential Access
High
- Category
- Privilege Escalation
- Content
- At least 1 uppercase letter - At least 1 number - At least 1 special character - Token Storage: Use flutter_secure_storage for iOS Keychain and Android Keystore - Session Timeout: 30 days, configurable - Rate Limiting: Max 5 login attempts per 15 minutes
- Confidence
- 70% confidence
- Finding
- Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Unvalidated Output Injection
High
- Category
- Output Handling
- Content
## 💡 Pro Tips 1. **Iterate**: Start with basic version, add complexity as needed 2. **Test Early**: Run generated code immediately to validate 3. **Customize**: Adjust generated code to match your style 4. **Save**: Keep successful prompts for future use 5. **Share**: Contribute successful prompts back to community
- Confidence
- 80% confidence
- Finding
- Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
Vague Triggers
Medium
- Confidence
- 95% confidence
- Finding
- The activation guidance says to invoke the skill whenever a user asks for help creating a prompt, which is a broad trigger that can cause the skill to activate in many loosely related contexts. Overbroad activation can lead to unintended routing, prompt interference, or accidental exposure of this skill's behavior in situations where a more specific or safer skill should handle the request.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
### Immediate Actions 1. **Create GitHub Repository** ```bash # Go to https://github.com/new # Name: skill-prompt-generator
- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
**Input:** ``` Create a prompt for user authentication in my Flutter app ``` **Output:**
- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Vague Triggers
Medium
- Confidence
- 95% confidence
- Finding
- The README instructs users to activate the skill with a very broad phrase like 'Just ask for help creating a prompt,' which risks unintended invocation during normal conversation. In an agent ecosystem, overly generic activation guidance can cause this skill to trigger when the user did not explicitly intend to use it, increasing prompt-surface exposure and potentially interfering with routing to more appropriate skills.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
Attempted: - Reinstalled pods - Cleaned build folder - Checked permissions in Info.plist Provide: 1. Root cause analysis
- Confidence
- 75% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Intent-Code Divergence
Medium
- Confidence
- 92% confidence
- Finding
- This section makes concrete security guarantees such as sanitization, input validation, review, and local-only processing, but the SECURITY.md file itself does not provide evidence those controls actually exist or are enforced. Overstated security claims can mislead users into trusting generated prompts or handling sensitive data less cautiously, which increases risk if the implementation does not match the documentation.
External Transmission
Medium
- Category
- Data Exfiltration
- Content
### Data Privacy - ❌ **No data collection**: This skill doesn't send data to external servers - ❌ **No tracking**: We don't track how you use generated prompts - ✅ **Local processing**: All prompt generation happens locally - ✅ **Your prompts are yours**: Generated prompts are not stored or shared
- Confidence
- 70% confidence
- Finding
- Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Intent-Code Divergence
Medium
- Confidence
- 94% confidence
- Finding
- The architecture diagram asserts a 'sandboxed' template engine and labels output as 'safe to use', which are strong assurances that may not be true in practice. If these guarantees are inaccurate, users and reviewers may underestimate prompt-injection or unsafe-template risks and rely on nonexistent protections.
Vague Triggers
Medium
- Confidence
- 93% confidence
- Finding
- The skill description is broad enough to match a large range of ordinary user requests such as help with writing, education, business, programming, and general prompt improvement. This can cause the skill to be invoked unnecessarily often, increasing its influence over unrelated conversations and expanding the attack surface for prompt injection or policy-bypassing behavior if the skill content is ever modified or abused.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
3. الوصف: AI Prompt Generator skill for OpenClaw with Flutter templates 4. نوعه: Public 5. لا تضف README (لدينا واحد) 6. اضغط "Create repository" ``` ### 2️⃣ رفع الملفات
- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
3. lلوصف: AI Prompt Generator skill for OpenClaw with Flutter templates 4. نوعo: Public 5. لl تضف README (لدينl وlحد) 6. lضغط "Create repository" ``` ### 2️⃣ رفع lلملفlت
- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Missing User Warnings
Medium
- Confidence
- 90% confidence
- Finding
- The README explicitly tells users to use AI-generated code as a starting point and customize it, but it does not pair that guidance with a clear requirement to review, test, and security-audit the output before use. In a prompt-generation skill that may produce implementation guidance for authentication, game logic, and other code, this can normalize unsafe trust in generated code and increase the chance that insecure or incorrect code is adopted.
Missing User Warnings
Medium
- Confidence
- 93% confidence
- Finding
- The monetization template explicitly includes analytics, ad integration, and purchase flows, but provides no prompt guidance to surface privacy, consent, tracking, retention, or child-safety disclosures. Because this skill is a prompt generator, omissions in the template can propagate into downstream app designs that collect user data or use ad SDKs without adequate user-facing warnings or compliance considerations, especially for mobile games aimed at broad audiences.
Natural-Language Policy Violations
Low
- Confidence
- 81% confidence
- Finding
- This markdown file presents all operational instructions exclusively in Arabic and does not indicate that the language is optional, user-selectable, or justified by a regional requirement. Under the policy rule for language/locale constraints, that can be considered a natural-language policy issue because it implicitly forces one language for users of the skill documentation.
Vague Triggers
Low
- Confidence
- 89% confidence
- Finding
- This manifest description presents the skill as a general-purpose "Comprehensive AI Prompt Generator" for multiple domains, but it does not define when the skill should activate or what requests it should and should not handle. For manifest files, this lack of trigger specificity can contribute to overly broad invocation behavior if the host uses description text for routing.
Static analysis
No suspicious patterns detected.