Security audit

Prompting

Security checks for vulnerabilities and agentic risk

Overview

This prompt-writing skill is mostly documentation, but it asks the agent to keep persistent personal prompting memory and includes unsafe prompt-priority advice.

Review this skill before installing. Use it only if you are comfortable with a local ~/prompting folder storing style notes, corrections, and prompt history, and periodically inspect or delete those files. Treat any advice about user messages overriding system prompts as incorrect.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Instruction Override

High

Category: Prompt Injection
Content: - Benefits from "Let's think step by step" - More tolerant of verbose prompts - JSON mode available and reliable - User message can override system - Good at creative variation **Works well:** Chain-of-thought, detailed examples
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Instruction Override

High

Category: Prompt Injection
Content: - **Start of prompt:** Sets overall behavior - **End of prompt:** Last thing model "remembers" - **Both:** For critical constraints - **In user message:** Can override system prompt ## Output Anchoring Start the assistant response:
Confidence: 94% confidence
Finding: The phrase 'In user message: Can override system prompt' directly instructs prompt override behavior, which is a classic jailbreak-enabling pattern. Even if intended as prompting advice, it can be reused to attempt circumvention of safety or policy instructions, making it materially risky in a document about prompt engineering techniques.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly directs storage of prompt history, user voice, and learned corrections under the user's home directory, but provides no consent, minimization, retention, or deletion guidance. Because these files may contain sensitive personal writing samples, preferences, and prior interactions, they create a real privacy and data-retention risk if accessed by other tools, users, or future sessions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The instruction to store writing style, preferred models, and past corrections in `~/prompting/memory.md` encourages persistent collection of potentially sensitive personal content without any user-facing warning. Writing samples and corrections can reveal identity, habits, or confidential material, so silent retention increases privacy exposure beyond the immediate task.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Persistently logging natural-language preferences and corrections creates a durable record that can accumulate sensitive contextual information over time. Even if intended for personalization, this retained free-text memory may later be exposed, repurposed, or queried in ways the user did not expect, making the risk contextually meaningful in a prompting skill that handles user-authored content.

Ssd 1

Medium

Confidence: 88% confidence
Finding: This section explicitly teaches that placing constraints in the user message can override higher-priority instructions, which normalizes prompt-priority confusion and can enable instruction-bypass behavior. In a prompting skill, that guidance is more dangerous because readers may operationalize it to defeat system safeguards or policy controls in other contexts.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: Line L48 gives a language-specific instruction, "Translate this to Spanish," as a generic prompting example. Because the policy forbids forcing a specific language without user opt-in or justification, this natural-language example can be read as endorsing a fixed locale choice without any indication that the user selected it.

Static analysis

No suspicious patterns detected.