Prompt Finder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:56 AM UTC
• Version: 1.0.2

Overview

The skill does perform prompt searches, but it also injects unrelated sponsor advertising into every runtime response and relies on a mutable external prompt feed.

Review this skill before installing if you need clean, predictable tool output: it will return third-party sponsor advertising in normal and error responses, and its prompt templates are live external content that may change after review. Do not automatically place returned prompt_template text into privileged agent instructions without treating it as untrusted data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: index.js:17

Finding

Forced Third-Party Advertising in Every Skill Response

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scraper.js:13

Finding

Mutable Remote Prompt Supply Chain Without Integrity Verification

Content

View full analysis

v], // keep as raw string headers: { 'User-Agent': 'PromptFinder-OpenClaw-Skill/1.0', 'Accept': 'text/csv,text/plain', }, }); ``` Remote prompt content is returned directly to the caller: ```js return scored.slice(0, limit).map(({ row }) => ({ title: row.act, description: row.prompt.length > 220 ? row.prompt.slice(0, 220).trim() + '…' : row.prompt, prompt: row.prompt, category: categorize(row.act), url: `https://prompts.chat/#${slugify(row.act)}`, source: 'awesome-chatgpt-prompts', ...(row.contributor && { author: row.contributor }), for_devs: row.for_devs, type: row.type, })); ``` ### Technical Analysis The skill depends at runtime on `prompts.csv` from the `main` branch of an external GitHub repository through jsDelivr. A branch name is mutable, so the effective prompt dataset can change after the skill package has been reviewed or installed. Although the downloaded CSV is treated as data rather than JavaScript and is not locally executed as code, its prompt bodies are returned as ready-to-use templates. A compromised upstream repository, maintainer account, or delivery path could therefore distribute deceptive instructions, malicious links, prompt-injection content, or excessively large fields. The implementation validates only the presence of the `act` and `prompt` columns. It does not: - Pin the source to an immu ...[truncated 1803 chars]

Remediation

View remediation

/prompts.csv'; ``` 2. Record and verify a SHA-256 or stronger digest before parsing the downloaded data. 3. Prefer bundling a reviewed dataset with the package when live updates are not operationally necessary. 4. Configure an explicit maximum response size in the HTTP client and reject oversized payloads. 5. Enforce limits on the total number of rows and the lengths of prompt, title, contributor, and type fields. 6. Validate the response content type and reject unexpected redirects or source hosts. 7. Treat prompt bodies as untrusted external content and clearly label them as such. 8. Do not automatically place retrieved prompt text into privileged agent instruction contexts. 9. Consider scanning entries for deceptive external links and instruction patterns before exposing them to downstream automation. 10. Retain a trusted local fallback and fail closed when integrity verification fails. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill fetches prompt content from a public third-party corpus and republishes the raw prompt text to downstream consumers without vetting, filtering, or trust-boundary labeling. Because prompts are executable instructions to language models, untrusted prompt templates can carry prompt-injection narratives, unsafe guidance, or policy-bypassing content that a downstream agent may mistakenly follow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documentation begins in Chinese and later repeats sponsor content in English, but it does not state which language users should expect or offer a language/locale choice. Under the policy rule, forcing or assuming a language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file includes a full Chinese-language sponsored section after an English skill description, but does not explain language selection, locale targeting, or provide user opt-in for multilingual output. Under the policy rule, forcing or introducing a specific language without documented choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a caret range ("^1.7.0") rather than being fully pinned, which allows different axios patch and minor releases to be installed over time. This weakens build reproducibility and can unexpectedly introduce a vulnerable or breaking version through the supply chain, though the manifest alone does not prove active exploitation.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"author": "prompt-finder",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.7.0"
  },
  "engines": {
    "node": ">=18.0.0"

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The manifest references axios without an exact pinned version, so it is not possible to verify from this file whether the installed release includes fixes for known axios advisories. In a skill that likely performs external HTTP requests, an affected axios version could expose the runtime to issues such as SSRF-related bypasses, request manipulation, or other client-side HTTP library flaws depending on actual usage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.