Security audit

coding-prompt

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-coaching skill with a disclosed, confirmation-gated learning file update, and I found no hidden code, external retrieval, credential access, or destructive behavior.

Install this if you want an opinionated coding-prompt coach. Be aware that after activation it may keep giving limited coaching alerts during the session, and if you use “update skill” it may store approved preferences or reusable lessons in its learnings file for future use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Self-Modification

High

Category: Rogue Agent
Confidence: 98% confidence
Finding: The skill metadata explicitly allows 'update skill' to evolve its knowledge base, which is a self-modification pathway. Any mechanism that lets a skill alter files based on conversation content can be abused through prompt injection or social engineering to change future behavior and persistence.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: coding-prompt version: "1.1.0" description: AI coding prompt optimizer and coach. This skill should be used whenever the user is writing programming prompts or instructions to an AI during active coding sessions— including when starting new features, correcting AI's direction, reviewing code, or requesting tests. Trigger when: explicit request to optimize/improve/refine a prompt, the user activates this skill (激活编程提示词), or during coding tasks where instructions to AI are vague, missing constraints, missing acceptance criteria, or could benefit from prompt engineering best practices. Also trigger when the user says "更新技能" or "update skill" to evolve this skill's knowledge base. Do NOT trigger for non-coding prompts or general chat. --- # Coding Prompt — AI 编程提示词最佳实践

Self-Modification

High

Category: Rogue Agent
Confidence: 98% confidence
Finding: This section reiterates that saying 'update skill' should invoke the evolution protocol, making self-modification a first-class conversational feature. Repeated exposure of this trigger lowers the barrier to misuse and increases the likelihood that ordinary user input or adversarial content will activate a write-capable path.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
**Golden rule**: The user's original instruction always takes priority. Alerts and suggestions are additive, never overriding. **Evolution on demand**: When the user says "更新技能" / "update skill", follow Section 7 below. ---

Self-Modification

High

Category: Rogue Agent
Confidence: 99% confidence
Finding: The evolution protocol formally defines a target file for modification, confirming a built-in mechanism for persistent self-alteration. Even though it narrows writes to references/learnings.md, it still creates a durable memory/edit channel that can be influenced by adversarial session content and later affect the skill's outputs.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
## 7. Evolution Protocol / 进化协议 > Trigger: 更新技能 / update skill > Target: `references/learnings.md` ONLY ### File Permission Matrix

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
| `SKILL.md` | 🔒 **READ-ONLY** | Constitution — defines the skill |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says the skill should trigger during broadly defined coding situations such as vague instructions or missing constraints, which can cause activation without a clear user request. Ambiguous activation increases the chance the skill will run in ordinary conversations and perform actions or inject guidance unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list includes generic phrases such as 'improve my prompt' and 'check my prompt' that may occur in ordinary discussion and lack strong boundary conditions. This can lead to accidental activation and make downstream behaviors harder for users to predict or control.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill persists for the rest of the session after one trigger, creating an overly broad activation window. Persistent state can cause the skill to keep intervening after the original task has changed, leading to unwanted prompt injection, monitoring, or interference across unrelated later turns.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill declares references/learnings.md as append-only, but later instructs the agent to consolidate, update entries, and rewrite the complete file. This contradiction weakens safety boundaries around file modification and can normalize broader state changes than users may expect, increasing the chance of unintended or unauthorized edits.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase described as being activated by "更新技能" is broad and context-agnostic, so it could be invoked during ordinary conversation or unrelated coding sessions. In a skill that extracts and persists reusable learnings from conversations, accidental activation can cause unintended capture, storage, or mutation of skill knowledge based on unreviewed context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language examples in the template specify 'English comments,' 'International docs in English,' and 'SKILL.md follows same language standard.' This prescribes a specific language for outputs and documentation without offering user choice or explaining a justified regional/compliance need, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: Line L009 explicitly instructs replacing "应该/should" with "不能/must NOT," embedding a bilingual language convention as a rule. Because the document does not state that language choice is optional or context-specific, this can be read as forcing a particular language/locale style without user opt-in.
Content: No source excerpt is available for this finding.