ClawHub
Back to skill

Security audit

Optimize Prompt

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently optimizes prompts without executing the underlying task, with only minor install and disclosure cautions.

Before installing, prefer a pinned ClawHub installer and skill version instead of the README's `@latest` example. If you wire the Python library to a remote model provider, treat the prompt text as data sent to that provider and avoid including secrets unless your provider setup allows it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:35
Finding

Unpinned Installation Command Executes Mutable Supply-Chain Components

Content
View full analysis

Vulnerability Details

File Location: README.md:35 (duplicated at README.md:222)
Vulnerability Type: Unpinned third-party installer and package reference
Risk Level: Medium

Vulnerable Code Snippet

bash
npx clawhub@latest install @margaretzybgl/optimize-prompt

Technical Analysis

The documented installation command asks npx to download and execute the mutable latest release of the third-party clawhub package. It also installs @margaretzybgl/optimize-prompt without selecting an immutable version or integrity digest.

Consequently, the code executed by this command can change after this repository has been audited. A compromise of the relevant package registry, publisher account, installer package, or subsequently resolved skill release could cause users to execute content that was not present in the reviewed project. Reviewing the current Python source does not establish the safety of future artifacts resolved through these mutable package references.

The project itself contains no evidence of malicious payloads, hidden network clients, command injection, persistence, credential access, or unsafe deserialization. The issue is specifically the mutable supply-chain installation path presented to users.

Attack Path

  1. An attacker compromises the publisher account, package registry, or release process for clawhub or the installed skill package.
  2. The attacker publishes a malicious release selected by the latest tag or by the unversioned skill identifier.
  3. A user follows the installation command from the README.
  4. npx downloads and executes the newly resolved installer package.
  5. The malicious installer or skill artifact runs with the permissions of the user invoking the command.
  6. Depending on those permissions and the malicious payload, it could access user-readable files, credentials available to the process, project data, or modify local agent configuration.

...[truncated 555 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a reviewed exact version rather than using latest, for example:

    bash
    npx clawhub@<reviewed-version> install @margaretzybgl/optimize-prompt@<reviewed-version>

  2. Where supported, pin packages by immutable digest or lockfile integrity value in addition to the semantic version.

  3. Apply the same correction to the duplicate installation command at README.md:222.

  4. Publish expected package checksums or signed provenance and document how users can verify them before installation.

  5. Require multi-factor authentication and protected publishing workflows for package publisher accounts.

  6. Run installation with a non-privileged account in an isolated environment and avoid exposing unnecessary credentials or sensitive environment variables.

  7. Use a controlled registry or approved internal mirror for production deployments.

  8. Add automated documentation checks that reject mutable tags such as latest in executable installation examples.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/optimize_prompt_v1/__init__.py (reported line 12)May include surrounding context.

python
def optimize_prompt_v1(prompt: str, *, config: OptimizerConfig | None = None, model=None, metrics: MetricsCollector | None = None) -> dict:
    """Optimize a user prompt into an auditable downstream-agent instruction."""
    return PromptOptimizer(config=config, model=model, metrics=metrics).optimize(prompt).to_dict()


__all__ = ["ApproximateTokenCounter", "DeterministicValidator", "InvalidModelResponse", "MetricsCollector", "ModelOptimization", "OptimizationResult", "OptimizerConfig", "PromptIR", "PromptOptimizer", "RetryableModelError", "TokenCounter", "ValidationReport", "optimize_prompt_v1"]

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tests/test_optimizer.py (reported line 34)May include surrounding context.

python
def optimize_prompt_v1(prompt: str, *, config: OptimizerConfig | None = None, model=None, metrics: MetricsCollector | None = None) -> dict:
    """Optimize a user prompt into an auditable downstream-agent instruction."""
    return PromptOptimizer(config=config, model=model, metrics=metrics).optimize(prompt).to_dict()


__all__ = ["ApproximateTokenCounter", "DeterministicValidator", "InvalidModelResponse", "MetricsCollector", "ModelOptimization", "OptimizationResult", "OptimizerConfig", "PromptIR", "PromptOptimizer", "RetryableModelError", "TokenCounter", "ValidationReport", "optimize_prompt_v1"]

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to execute npx clawhub@latest install ..., which pulls and runs the latest CLI version at install time rather than a pinned, reviewed release. If the upstream package is compromised or a breaking/malicious update is published, users following the documentation could execute untrusted code in their environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The Chinese section repeats the same unpinned npx clawhub@latest install ... instruction, creating the same supply-chain risk for another audience. Using @latest means documentation consumers may unknowingly execute newly published code that has not been vetted by the skill author or by their organization.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code sends the full original prompt to self.model.optimize(original), which is a network/model operation that may transmit user-provided or system-derived data. The file contains no confirmation prompt, user-facing log/print, or comment/docstring warning that prompt contents may be sent to an external model service.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The README says to use the skill before handing a 'conversational, repetitive, multi-constraint, or ambiguous request' to an Agent, model, or MCP workflow. This is a very broad natural-language condition without clear trigger boundaries or exclusion examples, which could lead to over-invocation in many ordinary prompt-authoring situations.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code file contains natural-language test prompts such as '输出英文' and similar forced-output language constraints. Under the stated policy, language/locale requirements can be findings when they mandate a language without opt-in or justification, even when embedded in code strings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The test data includes strings like '输出中文摘要' and other Chinese-output requirements as fixed behavior. Because the policy applies to all file types, these hard-coded language constraints can be treated as organizational policy violations unless they are clearly optional or justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.