Promptguard

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:46 AM UTC
• Version: 0.1.1

Overview

PromptGuard is a small local API for scanning text for prompt-injection patterns, with no evidence of hidden exfiltration, persistence, or privilege escalation.

Install only in an environment where running a local HTTP service is acceptable. Avoid sending secrets or private data through the scanner unless you trust the local runtime, and consider pinning dependency versions before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-12 and SKILL.md:33
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable code at lines 11-12:

yaml

    - kind: uv
      packages: [fastapi, uvicorn, pydantic]

Vulnerable code at line 33:

bash

pip install fastapi uvicorn pydantic

Technical Analysis

The installation metadata and documented installation command specify package names without exact versions, integrity hashes, or a lockfile. Consequently, the package resolver retrieves whichever compatible releases are available at installation time. The resulting environment is not reproducible and may contain newly introduced vulnerabilities, incompatible changes, or compromised package releases that were not present during the Skill review.

The dependency names are consistent with the Skill's functionality, and there is no evidence of typosquatting, dependency confusion, or an unsafe package index in the audited files. The risk arises from mutable dependency resolution rather than from a currently identified malicious package.

Attack Path

1. An attacker compromises a future release, maintainer account, or distribution path of one of the named dependencies.
2. The compromised release is published under the legitimate package name.
3. A user installs the Skill by using its metadata or documented pip install command.
4. Because no version or hash is enforced, the package manager resolves and downloads the compromised release.
5. Attacker-controlled code executes during package installation, application startup, or request processing.

This path is conditional on compromise of the dependency supply chain; no such active compromise was identified in the project.

Impact Assessment

A compromised dependency could execute code with the privileges of the account installing or running PromptGuard. Depending on the deployment environment, ...[truncated 502 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each direct dependency to an exact, reviewed version in both the installation metadata and user-facing installation instructions.
2. Generate and commit a lockfile that includes resolved transitive dependencies.
3. Use cryptographic hashes for downloaded distributions, such as a hash-locked requirements file installed with pip install --require-hashes.
4. Install packages only from an explicitly configured trusted package index.
5. Add automated dependency vulnerability and provenance scanning to the release process.
6. Regularly update dependencies through a controlled review process, rerunning tests and security checks before changing locked versions.
7. Keep SKILL.md installation metadata synchronized with the lockfile or pinned requirements to prevent alternative unpinned installation paths.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

Then send a POST request:

bash

curl -X POST http://localhost:8000/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"text": "What is the weather in London today?"}'