Dev Prompts

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 2.0.1

Overview

This prompt pack is mostly coherent, but its docs tell users to download and run an unverified Python file from a mutable GitHub branch while also claiming it has no code or network use.

Use the bundled PROMPTS.md directly. Do not run the documented curl/python flow unless you independently inspect the downloaded script, pin it to an immutable commit or verified release, and run it in a low-privilege environment without secrets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:34

Finding

Unverified Python Payload Retrieved from a Mutable Remote Branch

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34 (download), followed by local execution in the Quick Start section
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/dev-prompts/main/dev_prompts.py
# Or copy the file anywhere — it's self-contained.

The downloaded file is subsequently invoked as follows:

bash

python dev_prompts.py --help        # list options

Technical Analysis

The installation procedure downloads a Python program from the mutable main branch of a personal GitHub repository. The artifact does not contain the downloaded dev_prompts.py, so its effective code was not part of the audited project.

The instructions provide no immutable commit pin, checksum, digital signature, or other integrity verification. Therefore, the remote file can change after this skill has been reviewed. Compromise of the repository, maintainer account, branch, or hosting path could replace the expected program with arbitrary Python code.

Although curl does not execute the file automatically, the documented Quick Start explicitly instructs the user to run it. Python executes top-level code before processing the expected --help behavior, allowing a malicious replacement to run immediately.

This remote execution path is unnecessary for the skill's minimum declared functionality. The project already bundles the complete static prompt collection in PROMPTS.md, and requirements.txt identifies the project as a Markdown prompt pack with no Python dependencies. It also conflicts with the statement that the skill has “no code, no network.”

Attack Path

1. An attacker compromises the maintainer's GitHub account, repository, or mutable main branch.
2. The attacker replaces dev_prompts.py with code that performs malicious actions a ...[truncated 1175 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the Python download and execution instructions because PROMPTS.md already provides the declared prompt-library functionality.
2. If a CLI is genuinely required, include its reviewed source directly in the skill package so the audited artifact matches the executed code.
3. If external retrieval cannot be avoided:
   • Pin the URL to a specific immutable Git commit rather than main.
   • Publish a trusted SHA-256 digest and verify it before execution.
   • Prefer signed release artifacts and verify the maintainer's signature.
   • Fail closed if verification does not succeed.
   • Review the downloaded content before invoking Python.
4. Avoid running the program with administrator, root, or broadly privileged CI credentials.
5. Correct the “no code, no network” claim so the documentation accurately discloses all network and execution behavior.
6. Add automated checks preventing installation URLs from reverting to mutable branches.

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:36

Finding

README Directs Users to Download and Execute an Unverified Remote Python Program

Content

View full analysis

Vulnerability Details

File Location: README.md:36 (download), followed by local execution in the Quick Start section
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/dev-prompts/main/dev_prompts.py
# Or copy the file anywhere — it's self-contained.

The README then instructs users to execute the retrieved file:

bash

python dev_prompts.py --help        # list options

Technical Analysis

The README establishes a download-and-execute chain involving a Python file hosted on a mutable branch outside the audited artifact. No version pin, digest, signature, or provenance verification binds the retrieved content to the reviewed project version.

As a result, the instructions transfer control over the effective executable payload to the current contents of the external main branch. A later benign update, account compromise, or malicious repository modification can change what users execute without any corresponding change to this skill package.

The behavior exceeds least functionality requirements because the bundled PROMPTS.md is already a complete static prompt pack. The README's separate assertion that the project has “no code, no network” is inconsistent with these instructions and may prevent users from making an informed security decision.

Attack Path

1. An attacker gains the ability to modify the external repository or its main branch.
2. The attacker adds malicious startup behavior to dev_prompts.py.
3. A user follows the README installation command.
4. The mutable remote payload is written into the user's current directory.
5. The user invokes the downloaded script using the documented Python command.
6. Malicious code executes before or instead of displaying help and acts with the user's permissions.

I

...[truncated 603 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the download-based installation flow with instructions to use the bundled PROMPTS.md.
2. If the Python CLI is part of the intended product, package its reviewed source with the skill and version it together with the documentation.
3. For any unavoidable external artifact:
   • Reference an immutable commit or versioned release.
   • Verify a trusted cryptographic checksum or signature before execution.
   • Use an installation script that aborts on download or verification failure.
   • Document the external code, network access, and trust boundary explicitly.
4. Remove or revise the inaccurate “no code, no network” statement.
5. Recommend execution in a low-privilege, isolated environment without production secrets.
6. Add release controls that compare documentation URLs against an approved list of immutable artifacts.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is described as a broad, general-purpose pack of developer prompts without clear activation boundaries or narrow task constraints. In agent environments, overly broad skills can be invoked for many unrelated developer requests, increasing the chance of prompt overreach, unintended interference with other skills, or unsafe application in contexts that need tighter scoping.

Content

No source excerpt is available for this finding.