RUNE Prompt Amplification

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:09 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it needs review because it runs unpinned external Python code and sources a broad local secrets file.

Install only if you are comfortable trusting the external RUNE repository and its wand.py at run time. Prefer a pinned commit, a dedicated credential file or explicit RUNE_API_KEY environment variable, restricted file permissions, and avoid sending confidential prompts through this skill until its data flow is documented.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42
• Finding: Execution of Unpinned Code from an External Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:42-48`; execution occurs at `main.sh:12-13` and `main.sh:53-58` **Vulnerability Type**: Mutable remote payload retrieval and local execution **Risk Level**: High ### Vulnerable Code ```bash # 1. Clone RUNE repo git clone https://github.com/mrsarac/master-prompts ~/Documents/GitHub/rune # 2. Add API key to ~/.secrets echo "export RUNE_API_KEY=your_key" >> ~/.secrets # 3. Test echo "Hello" | bash main.sh ``` The downloaded implementation is subsequently selected and executed by `main.sh`: ```bash RUNE_DIR="${RUNE_DIR:-/Users/mustafa/Documents/GitHub/rune}" WAND="$RUNE_DIR/wand.py" ``` ```bash cd "$RUNE_DIR" # Strip ANSI colors from output for clean piping python3 "$WAND" inscribe "$PROMPT" \ | sed $'s/\033\[[0-9;]*m//g' ``` ### Technical Analysis The Skill does not include or implement its declared prompt-amplification engine. Instead, its setup instructions clone a mutable external Git repository and `main.sh` executes `wand.py` from that repository. The clone operation does not pin an immutable commit, verify a cryptographic checksum, validate a signature, or otherwise authenticate the exact content that will be executed. Consequently, the effective executable payload can change after this Skill has been audited. There is also a provenance inconsistency: - `SKILL.md:43` directs users to clone `github.com/mrsarac/master-prompts`. - `SKILL.md:8,55` and `README.md:75` identify repositories under `github.com/neurabytelabs`. This inconsistency makes it harder for users to determine which repository is authoritative and increases the risk of source substitution. `README.md:75` itself is only a GitHub hyperlink and does not directly execute or download anything; the actionable remote retrieval is the clone command in `SKILL.md`. ### Attack Path 1. A user installs the reviewed Skill and follows its documented setup procedure. 2. The user clones the current state of `mrsarac/master-prompts` ...[truncated 1145 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the required prompt-amplification implementation in the Skill package so that the audited code is the code executed. 2. If external retrieval is unavoidable, pin the repository to a full immutable commit SHA rather than a branch or default HEAD. 3. Publish and verify a cryptographic checksum or signed release before execution. 4. Use a single, clearly documented authoritative repository and correct the inconsistency between `mrsarac/master-prompts` and `neurabytelabs/rune`. 5. Refuse to execute `wand.py` if its expected commit, checksum, or signature cannot be verified. 6. Review and constrain the external component's network and filesystem access before execution. 7. Consider running the external component in a sandbox with a minimal environment, read-only filesystem access, and restricted network access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: main.sh:15
• Finding: Arbitrary Shell Execution Through Sourcing of a General Secrets File<![CDATA[ ## Vulnerability Details **File Location**: `main.sh:15-20` **Vulnerability Type**: Unsafe secrets loading and excessive credential exposure **Risk Level**: High ### Vulnerable Code ```bash # ── Load secrets for API key ────────────────────────────── if [[ -f "$HOME/.secrets" ]]; then # shellcheck disable=SC1091 source "$HOME/.secrets" fi ``` ### Technical Analysis The `source` command executes the target file as shell code in the current process. It does not safely parse a single `RUNE_API_KEY` value. Any command, function definition, shell option, redirection, or variable modification stored in `$HOME/.secrets` is executed when the Skill starts. This exceeds the minimum privilege required for prompt amplification. The Skill only needs one API key, but it executes an entire general-purpose secrets file. It then starts the externally supplied `wand.py`, which inherits all exported environment variables loaded by that file—not only `RUNE_API_KEY`. The fixed filename `$HOME/.secrets` also encourages the aggregation of unrelated credentials. If other entries use `export`, those values become accessible to the Python child process. ### Attack Path 1. An attacker or another compromised local tool gains the ability to alter `$HOME/.secrets`. 2. The attacker adds a shell command, command substitution, malicious function, or other executable shell syntax. 3. The user invokes `main.sh`. 4. Bash executes the attacker-controlled content through `source` before validating `wand.py` or the API key. 5. The malicious commands run with the user's permissions. 6. Independently, a malicious or compromised `wand.py` can inspect any unrelated exported secrets inherited from the sourced file. ### Impact Assessment If `$HOME/.secrets` is attacker-controlled or improperly protected, exploitation provides arbitrary command execution with the invoking user's privileges. Potential consequences include: - Reading, changing, or deleting user-accessible files. - Cre ...[truncated 423 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not execute secrets files with `source`, `eval`, command substitution, or equivalent shell evaluation. 2. Prefer requiring callers to provide `RUNE_API_KEY` through the process environment. 3. If file-based storage is required, use a dedicated data-only file containing only this credential and parse it without shell evaluation. 4. Validate file ownership and permissions before reading a credential file; reject files writable by other users. 5. Launch Python with a minimal environment, for example by allowlisting only required variables rather than inheriting every exported secret. 6. Keep unrelated credentials in separate files or a platform credential manager. 7. Document that prompts and API credentials may be passed to the external RUNE implementation, including any expected network destination. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:34
• Finding: Mutable Package Execution Through npx latest<![CDATA[ ## Vulnerability Details **File Location**: `README.md:34-39` **Vulnerability Type**: Unpinned package-runner dependency **Risk Level**: Medium ### Vulnerable Code ```bash ## Install ```bash npx clawhub@latest install neurabytelabs/rune-skill ``` ``` ### Technical Analysis The documented installation command directs `npx` to retrieve and execute the package currently published under the mutable `latest` tag. The command does not pin an exact version, lock an integrity hash, or verify a package signature. Because `npx` executes the downloaded package's CLI, compromise of the package, registry account, release process, or mutable distribution tag could result in attacker-controlled code running during installation. The actual code executed may therefore differ from the version considered during this audit. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, or its release pipeline. 2. The attacker publishes a malicious release and assigns it the `latest` tag. 3. A user follows the README installation command. 4. `npx` downloads and executes the compromised package. 5. The package runs with the user's permissions and may alter files, steal credentials, or install modified Skill content. ### Impact Assessment A compromised package-runner dependency can execute arbitrary code with the invoking user's permissions. Potential scope includes: - Access to user-readable files and environment variables. - Modification of the installed Skill. - Credential theft and network exfiltration. - Installation of additional malicious dependencies or files. No evidence in the audited project proves that the current `clawhub` package is malicious. The confirmed issue is the lack of immutable version and integrity controls in the documented execution path. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specific audited version. 2. Where supported, pin and verify the package's integrity hash or signature. 3. Document the expected publisher, package version, and checksum. 4. Avoid transient package execution for security-sensitive installation workflows; prefer a verified, reproducible installation mechanism. 5. Audit new package versions before updating the documented pin. 6. Use lockfiles or equivalent immutable dependency metadata for every dependency involved in installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill advertises a simple prompt-transformation capability, but the documentation reveals additional sensitive behaviors: loading credentials from ~/.secrets, requiring an API key, ingesting stdin/CLI input, and depending on a separate local repository/script to perform the real work. This mismatch reduces user visibility into trust boundaries and can cause users to execute unreviewed external code with access to local secrets, which is a genuine security concern even if not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to run `npx clawhub@latest install ...`, which fetches and executes the latest package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute untrusted code simply by following the documentation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup instructions tell users to append an API key to ~/.secrets without explaining credential exposure, file permission requirements, or safer secret-management options. This can lead to accidental disclosure through weak file permissions, shell sourcing practices, backups, or reuse of a broadly trusted secrets file by other tools.

Session Persistence

Medium

• Category: Rogue Agent

Content

#
# Usage:
#   echo "Write a blog post about AI" | bash main.sh
#   bash main.sh "Write a blog post about AI"
#   bash main.sh                  # prompts interactively

set -euo pipefail

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script automatically sources $HOME/.secrets, which executes arbitrary shell code from a local file rather than safely reading only the needed variable. For a prompt-formatting skill, loading and executing a general secrets file is broader than necessary and can expose unrelated credentials or trigger unintended side effects in the user's shell context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Sourcing a secrets file without an explicit warning means the skill silently reads sensitive local material and executes its contents. Users invoking a simple prompt-amplification tool would not reasonably expect this level of access, which increases the risk of credential exposure and unsafe code execution from modified dotfiles.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends the full user prompt to an external Python tool/API path without any explicit warning, consent flow, or data-handling notice. Because prompts may contain proprietary or sensitive information, undisclosed transmission creates confidentiality risk even if the feature is functionally expected for a remote AI-backed tool.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest describes invocation/input behavior in a very broad way ('stdin or argument') and presents the skill as a generic prompt wrapper without any trigger constraints or scope limits. In an agent ecosystem, this increases the chance the skill is invoked on arbitrary user or system prompts, which can amplify prompt-injection risk and cause the skill to process sensitive context unexpectedly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The manifest explicitly requests access to sensitive material via environment variable 'RUNE_API_KEY' and files under '~/.secrets' without any user-facing disclosure of why those secrets are needed or how they are handled. This is dangerous because a prompt-amplification skill does not obviously require broad local secret-file access, and such access could enable accidental exposure or deliberate exfiltration of credentials during skill execution.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: This markdown file tells users to place `RUNE_API_KEY` in `~/.secrets`, which involves handling credentials, but it provides no warning about protecting that file or avoiding accidental disclosure. Under the markdown criteria for missing user warnings, credential-related behavior should be disclosed when it may affect user privacy or system security.

Static analysis

No suspicious patterns detected.