Security audit

Prompt-Engineering-workflow

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly builds structured prompts, but it includes maintenance scripts that can execute code from projects being validated or documented.

Install only if you want a Chinese-first prompt-engineering template and can avoid running its maintenance scripts on untrusted repositories. Treat scripts/validate_skill.py and assets/generate-api-docs.py as trusted-code-only tools; run them in an isolated environment if validating or documenting third-party content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/validate_skill.py:682
Finding: Validation of an Untrusted Skill Executes Its Project-Supplied Fingerprint Script
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: assets/generate-api-docs.py:136
Finding: API Documentation Generation Imports and Executes Project-Controlled Python Modules
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (102)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Large-scale compliance auditing, directory traversal, file hygiene inspection, and JSON/exit-code reporting are operational auditing behaviors, not merely prompt generation. When a skill understates these capabilities, agents may invoke broad local inspection logic in a context that did not justify it, increasing privacy and integrity risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Large-scale compliance auditing, directory traversal, file hygiene inspection, and JSON/exit-code reporting are operational auditing behaviors, not merely prompt generation. When a skill understates these capabilities, agents may invoke broad local inspection logic in a context that did not justify it, increasing privacy and integrity risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Large-scale compliance auditing, directory traversal, file hygiene inspection, and JSON/exit-code reporting are operational auditing behaviors, not merely prompt generation. When a skill understates these capabilities, agents may invoke broad local inspection logic in a context that did not justify it, increasing privacy and integrity risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Large-scale compliance auditing, directory traversal, file hygiene inspection, and JSON/exit-code reporting are operational auditing behaviors, not merely prompt generation. When a skill understates these capabilities, agents may invoke broad local inspection logic in a context that did not justify it, increasing privacy and integrity risks.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
- 契约门禁:见 [scripts/validate_skill.py](scripts/validate_skill.py)(用途:校验原子契约/深度段/指纹/依赖规则/信号表;运行:`python scripts/validate_skill.py --skill-dir . --strict`)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/model-adapters/claude.md (reported line 3)May include surrounding context.
md
# claude 模型适配器 <!-- MODEL-ADAPTER id: claude target: Anthropic Claude 系列(Opus / Sonnet / Haiku)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/model-adapters/deepseek.md (reported line 3)May include surrounding context.
md
# deepseek 模型适配器 <!-- MODEL-ADAPTER id: deepseek target: DeepSeek 系列(V3 / R1)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/model-adapters/gemini.md (reported line 3)May include surrounding context.
md
# gemini 模型适配器 <!-- MODEL-ADAPTER id: gemini target: Google Gemini 系列

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/model-adapters/openai.md (reported line 3)May include surrounding context.
md
# openai 模型适配器 <!-- MODEL-ADAPTER id: openai target: OpenAI GPT 系列(gpt-4o / o-series / gpt-5 系)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/model-adapters/qwen.md (reported line 3)May include surrounding context.
md
# qwen 模型适配器 <!-- MODEL-ADAPTER id: qwen target: 阿里通义千问系列(Qwen)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/validate_skill.py (reported line 330)May include surrounding context.
python
ex = read_text(skill_dir / "references" / "complete-examples.md") checked.append("references/complete-examples.md") if da is None or ex is None: return rules = re.findall( r"^\|\s*R(\d+)\s*\|\s*([a-z-]+)\s*(=|≥|≤)\s*D(\d)\s*\|" r"\s*([a-z-]+)\s*(=|≥|≤)\s*D(\d)\s*\|",

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and references scripts that use file reads, file writes, and shell execution, but it declares no explicit tool scope or permission boundaries. In an agent environment, this can cause the skill to run with broader-than-expected capabilities, increasing the chance of unintended filesystem modification or command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger text says to use the skill whenever a user asks to generate, optimize, grade prompts, or turn vague needs into professional prompts. This is a wide natural-language description without explicit exclusions or negative examples, so it could overlap with many ordinary requests about writing or refining text and cause unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This instruction requires all generated prompts to use Chinese punctuation and prohibits mixed-language formatting unless a specific language suffix is supplied. That imposes a default locale/style policy on users rather than offering a neutral default or asking for preference first.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script imports the target package and its submodules dynamically to generate docs, which executes module top-level code during analysis. If run against an untrusted or compromised package, this can trigger arbitrary code execution, filesystem/network access, or other import-time side effects under the user's privileges.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document title and all operative instructions are written in Chinese, and the data-flow section explicitly references lang=zh normalization, which indicates a Chinese-default locale. There is no visible user opt-in, alternative language option, or clear region-specific justification in this file, so it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill file is written entirely in Chinese and includes no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file uses Chinese throughout for headings, requirements, and checklist items, which effectively forces a specific language for users of the skill. Under the policy, language constraints should either provide user choice or be clearly documented as justified for a specific locale or compliance context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file is written entirely in Chinese and defines output-format requirements such as 'Markdown/纯文本/表格' and textual constraints without indicating that language is optional or user-selectable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is entirely written in Chinese and prescribes Chinese-language interaction patterns without indicating that the skill is locale-specific or offering a language fallback. This can cause users or downstream agents to misunderstand instructions, produce incorrect outputs, or be excluded from safely using the skill, especially in multilingual environments where prompt behavior must be predictable.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s instructional content is written entirely in Chinese and provides role/output templates only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This creates a natural-language locale policy concern because it implicitly fixes the interaction language without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This skill file presents all instructions and constraints only in Chinese, which effectively forces a specific language on users without any visible opt-in, alternative language, or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The entire skill file is written as mandatory operational guidance in Chinese, including the title and all instruction content, with no indication that language selection is optional or limited to a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger terms include very broad business words such as budget, cost, profit, and ROI, which can cause the finance domain atom to activate for general business or operational conversations that are not actually finance-specific. In a prompt-engineering framework, this can misroute tasks, inject inappropriate finance framing, and degrade downstream reasoning or produce misleading domain-specific advice where it does not belong.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The applicability signals include very broad everyday business terms such as '员工', '组织', and '企业文化', which can cause the HR domain atom to activate for loosely related requests. In a prompt-engineering skill, overbroad triggering can inject unnecessary HR-specific constraints or guidance into unrelated tasks, reducing reliability and potentially skewing outputs in sensitive personnel contexts.
Content: No source excerpt is available for this finding.