ClawHub
Back to skill

Security audit

Phy Prompt Diff

Security checks for vulnerabilities and agentic risk

Overview

This is a local prompt-comparison skill, and the scanner alerts come from quoted examples rather than hidden unsafe behavior.

Install only if you are comfortable with the agent reading and summarizing the prompt files you explicitly provide or reference. Avoid using it on prompts that contain secrets unless you are prepared for those contents to appear in the diff report.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

Input:

text
Always respond in JSON. Never include markdown. If the user asks about pricing, redirect to the sales team. You have access to the file system.

Units extracted:

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

Input:

text
Always respond in JSON. Never include markdown. If the user asks about pricing, redirect to the sales team. You have access to the file system.

Units extracted:

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

text
CONTRADICTION INTRODUCED: Two instructions in B conflict with each other.
  Check B-only instructions against all instructions in B for logical conflict:
  - "always respond in English" + "respond in the user's language"
  - "never mention competitors" + "compare options including alternatives"
  - "keep responses brief" + "always include detailed examples"

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
# Conflict patterns to detect:
CONFLICTS = [
    ("always respond in {lang}", "respond in the user's language"),
    ("never {action}", "you can {action}"),
    ("keep responses {short/brief/concise}", "always include {detailed/full/comprehensive}"),
    ("do not use {tool}", "use {tool} when"),

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
### 🟠 HIGH — Contradictions in Version B

**Contradiction 1:**
- Instruction 12: `"Always respond in English."`
- Instruction 34: `"Respond in the language the user writes in."`
> These directly conflict. Define which takes precedence, or add: "Respond in English unless the user explicitly writes in another language."

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
75% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- "diff these prompts", "compare prompt versions", "what changed in my prompt"
- "what changed in AGENTS.md", "prompt changelog", "system prompt diff"
- "what instructions did I add", "did I introduce any contradictions"
- "compare v1 and v2 of this skill", "summarize prompt changes"
- "/prompt-diff"

---