Phy Prompt Diff

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:53 AM UTC
• Version: 1.0.3

Overview

This is a local prompt-comparison skill, and the scanner alerts come from quoted examples rather than hidden unsafe behavior.

Install only if you are comfortable with the agent reading and summarizing the prompt files you explicitly provide or reference. Avoid using it on prompts that contain secrets unless you are prepared for those contents to appear in the diff report.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

Input:
```
Always respond in JSON. Never include markdown. If the user asks about pricing, redirect to the sales team. You have access to the file system.
```

Units extracted:

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

Input:
```
Always respond in JSON. Never include markdown. If the user asks about pricing, redirect to the sales team. You have access to the file system.
```

Units extracted:

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

```
CONTRADICTION INTRODUCED: Two instructions in B conflict with each other.
  Check B-only instructions against all instructions in B for logical conflict:
  - "always respond in English" + "respond in the user's language"
  - "never mention competitors" + "compare options including alternatives"
  - "keep responses brief" + "always include detailed examples"

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

# Conflict patterns to detect:
CONFLICTS = [
    ("always respond in {lang}", "respond in the user's language"),
    ("never {action}", "you can {action}"),
    ("keep responses {short/brief/concise}", "always include {detailed/full/comprehensive}"),
    ("do not use {tool}", "use {tool} when"),

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

### 🟠 HIGH — Contradictions in Version B

**Contradiction 1:**
- Instruction 12: `"Always respond in English."`
- Instruction 34: `"Respond in the language the user writes in."`
> These directly conflict. Define which takes precedence, or add: "Respond in English unless the user explicitly writes in another language."

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage

Content

- "diff these prompts", "compare prompt versions", "what changed in my prompt"
- "what changed in AGENTS.md", "prompt changelog", "system prompt diff"
- "what instructions did I add", "did I introduce any contradictions"
- "compare v1 and v2 of this skill", "summarize prompt changes"
- "/prompt-diff"

---

• Confidence: 75% confidence
• Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Static analysis

No suspicious patterns detected.