Security audit

Prompt Cache

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible local prompt cache, but it under-discloses plaintext retention of prompts, child names, and generated stories in a database.

Review this skill before installing in applications that handle private prompts, children's names, or confidential generated content. Use it only with a clearly scoped database, documented retained fields, access controls, encryption or equivalent protection where appropriate, and retention/deletion limits. The prompt_text field should either be removed or explicitly documented with user/operator consent.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/prompt_cache.py:27
Finding: Plaintext Retention of Prompts and Child-Associated Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/prompt_cache.py:28
Finding: Silent Suppression of All Cache Write Failures
Content: View full analysis
Remediation: View remediation
bool: h = hash_prompt(prompt, child_name, language) try: await db.execute( "INSERT OR REPLACE INTO prompt_cache " "(prompt_hash, child_name, language, story_json) " "VALUES (?, ?, ?, ?)", [ h, child_name.lower(), language, json.dumps(story, ensure_ascii=False), ], ) return True except ExpectedDatabaseError as exc: logger.warning("Cache write failed: %s", type(exc).__name__) return False ``` Use the concrete exception type supplied by the database adapter in place of `ExpectedDatabaseError`. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code does implement the core idea of normalized prompt hashing plus database-backed cache get/set behavior, so it is related to the declared purpose. However, the description overstates the capability and generality. This chunk only caches story_json records and is tailored to prompt, child_name, and language; it does not show generic caching for both LLM and TTS calls, nor any audio/result replay handling. It also does not implement fuzzy matching, despite the module docstring mentioning optional fuzzy matching. The claim about working with any database backend is not verifiable from this chunk because it depends on an abstract database module. Overall, the primary purpose is adjacent but materially narrower and more specialized than declared.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill encourages caching raw prompts and identifiers such as child_name and language, but does not warn that this can store sensitive user content and personal data at rest. In context, caching LLM/TTS inputs can retain secrets, private conversations, or children's identifiers longer than users expect, increasing privacy and compliance risk if the database is accessed, logged, backed up, or shared.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 38% confidence
Finding: The documentation explicitly states a specific normalization process before hashing, but the skill file provides no code here and points to a very small implementation file. This raises a possible intent-code divergence if the actual implementation hashes raw inputs or performs different normalization than documented.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.