Firm Prompt Security Pack

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:53 AM UTC
• Version: 1.0.0

Overview

This skill is a prompt-injection detection pack; the flagged jailbreak phrases are examples of attacks to detect, not instructions for the agent to follow.

Before installing, note that the skill is documentation for regex-based prompt scanning and depends on mcp-openclaw-extensions for the named tools. Review how your agent logs findings, since scanning all user messages can expose sensitive prompt content in logs if the surrounding integration records too much detail.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

iption: >
  Prompt injection and jailbreak detection pack.
  16 compiled regex patterns across 3 severity levels (CRITICAL, HIGH, MEDIUM).
  Supports single-prompt and batch scanning modes.
author: romainsantoli-web
license: MIT
metadata:
  openclaw:
    registry: ClawHub
    requires:
      - mcp-openclaw-extensions >= 3.0.0
tags:
  - security
  - prompt-injection
  - jailbreak
  - detection
  - llm-safety
---

# firm-prompt-security-pack

> ⚠️ Contenu généré par IA — validation humaine requise avant utilisation.

## Purpose

Protects LLM-powered agents from prompt injection attacks and jailbreak attempts.
Uses 16 compiled regex patterns to detect override instructions, ChatML injection,
DAN-style jailbreaks, base64 evasion, and data exfiltration attempts.

## Tools (2)

| Tool | Description | Mode |
|------|-------------|------|
| `openclaw_prompt_injection_check` | Scan a single prompt for injection patterns | Single |
| `openclaw_prompt_injection_batch` | Scan multiple pro

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- Direct role reassignment ("You are now...")

### HIGH
- DAN/jailbreak prompts ("Do Anything Now")
- JSON escape sequences targeting system prompts
- XML role tag injection
- "Forget everything" / memory wipe attempts

• Confidence: 80% confidence
• Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Instruction Override

High

• Category: Prompt Injection

Content

- firm-prompt-security-pack

# Scan a single prompt:
openclaw_prompt_injection_check prompt="Please ignore previous instructions and..."

# Batch scan:
openclaw_prompt_injection_batch prompts=[

• Confidence: 80% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The warning banner is written only in French, which imposes a specific language in the skill's natural-language documentation without offering a user choice or stating a justified locale constraint. This matches the language/locale policy violation category because the file does not indicate that French is optional or region-specific.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:66