BetterPrompt

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:24 AM UTC
• Version: 1.0.3

Overview

This BetterPrompt skill is a plausible CLI wrapper, but it can install/run a mutable third-party CLI and send prompts or local files to an external service without clear consent boundaries.

Review before installing. Use this only when you intend to use BetterPrompt, avoid sending private prompts or local files unless you are comfortable uploading them to that service, and prefer a pinned or sandboxed CLI install rather than a global @latest install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Global Installation of a Mutable Third-Party Dependency

Content

View full analysis

Remediation

View remediation

``` 2. Publish and verify the expected package integrity digest or registry-provided integrity metadata before installation. 3. Document the expected package registry, package namespace, publisher identity, and provenance information. 4. Prefer a project-local installation with a committed lockfile instead of a global installation where operationally possible. 5. Review package lifecycle scripts and consider installation with scripts disabled when they are not required: ```sh npm install --ignore-scripts --save-exact betterprompt@ ``` 6. Run the CLI with a dedicated, least-privileged account or inside a sandbox/container that exposes only required files and credentials. 7. Establish an explicit update process in which new versions are reviewed, verified, and pinned before the documented version is changed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md

After installing a skill with `betterprompt skill install`, suggest the human reset their session so the newly installed skill is loaded by OpenClaw.

#### Channel Display Rules

All content returned to users must render natively in their channel platform. Never send raw URLs, raw JSON, or unformatted dumps. The rules below apply to every content type the agent presents: search results, skill details, generation outputs, and resources.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The activation description is broad enough to match common user requests about generating content, discovering tools, or managing prompts, which can cause the skill to activate in situations where the user did not explicitly intend to use an external registry-backed CLI. In this context, overbroad activation increases the chance of unexpected external calls, installation flows, or data disclosure to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to send text, JSON payloads, image URLs, local image files, and stdin to the BetterPrompt service, but it does not warn the user that this data may leave the local environment and be transmitted to an external provider. This is dangerous because users may unintentionally expose sensitive prompts, documents, or local file contents during generation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.