Security audit

prompt-token-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple token-counting CLI, but its setup asks for unnecessary system-wide installation with elevated privileges.

Review the generated script before installing it. Prefer running it locally or placing it in a user-owned bin directory instead of using sudo, and pin or verify the gpt-tokenizer package version before installation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Unpinned Third-Party Package Installed Globally
Content: View full analysis
Remediation: View remediation
``` - Use `npm ci` with a committed lockfile for reproducible installation. - Where package functionality permits it, disable lifecycle scripts during installation: ```bash npm ci --ignore-scripts ``` - Verify the package publisher, source repository, integrity, and dependency tree before approving upgrades. - Run dependency vulnerability and provenance checks in CI, and review every dependency update before distribution. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:92
Finding: Unnecessary Privileged Installation into a System-Wide Executable Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The explicit use of sudo to move an executable into /usr/local/bin requires root privileges and creates a direct path for privileged modification of the host if followed automatically. Although the script itself appears simple, the skill asks the user to create the executable from inline content and then install it as root, which is a risky pattern because any hidden or later-modified content would execute with elevated trust on a persistent system path.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
Move it into PATH:

bash
sudo mv prompt-token /usr/local/bin/

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to move a custom script into /usr/local/bin using elevated privileges, which is a privileged system modification not strictly necessary to perform token analysis. While common in CLI setup guides, this increases risk because agents may execute a root-level file operation on unreviewed content from the skill, expanding impact if the generated script or path is tampered with.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The installation steps include a privileged system modification command without any warning, causing a user or agent to normalize use of sudo for routine setup. In an agent context, this is dangerous because it encourages elevated execution of instructions derived from potentially adversarial skill content without emphasizing review or safer non-privileged alternatives.
Content: No source excerpt is available for this finding.