Prompt Guard

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:34 AM UTC
• Version: 3.6.2

Overview

Prompt Guard appears defensive, but it needs Review because it enables outbound security-network behavior by default and includes under-disclosed host-audit/remediation utilities.

Install only if you are comfortable with default outbound calls for remote pattern updates and HiveFence threat reporting. For sensitive or regulated environments, disable API and HiveFence/network reporting before first use, review logging settings so prompt previews are not stored unexpectedly, and avoid running the Clawdbot audit --fix path unless you intend local permission changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill documentation advertises and demonstrates capabilities that imply access to environment variables, files, network services, and shell execution, but no declared permissions are presented alongside them. This creates a transparency and trust problem: users may install or invoke the skill without understanding its actual access surface, increasing the chance of unintended data exposure or unsafe execution in agent runtimes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is prompt-injection defense, but the described behavior extends into host auditing, permission changes, external reporting, threat-intelligence fetches, and broader DLP features. That mismatch is dangerous because users may grant trust based on a narrow security-tool description while the skill performs materially broader and potentially sensitive actions, including networked data handling and local system modification.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation claims threat reporting is opt-in and anonymized, but the nearby configuration/API narrative also says the API is enabled by default and uses a built-in beta key. In a security skill, contradictory defaults around outbound connectivity and reporting can mislead deployers into unintentionally permitting network access or telemetry, weakening expected privacy and supply-chain boundaries.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The README makes conflicting claims about API behavior: one section says API connectivity is enabled by default with a built-in beta key, while the configuration section says the API is optional and off by default. This can mislead deployers about whether the package will make outbound network connections automatically, creating consent, compliance, and unexpected data-flow risks.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Claiming the product works '100% offline' while also documenting API-enabled and network-integrated behavior is materially misleading. In a security product, this can cause operators to expose prompts, detections, or metadata externally under a false assumption that no network transmission occurs.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The Quick Start initializes the guard with API enabled by default and a built-in beta key, directly contradicting the earlier offline-first messaging. Default-on remote connectivity in a security scanning component can leak user inputs or threat telemetry without informed consent, especially when examples encourage copy-paste adoption.

Description-Behavior Mismatch

Low

• Confidence: 92% confidence
• Finding: The example configuration enables an external API by default and advertises a built-in beta key, which expands the skill from purely local pattern matching into networked behavior without explicit user opt-in. Even with reporting disabled in this block, default remote connectivity can leak metadata, create supply-chain risk through remote responses, and violate operator expectations for an offline security control.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: HiveFence is enabled with auto_report and auto_fetch turned on, so the skill will contact a remote threat-intelligence service and both send detection data and ingest remote patterns by default. For a defensive security skill, this materially increases privacy risk, creates an external dependency and trust boundary, and introduces a pathway for supply-chain style poisoning if the remote feed is compromised.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements a host/configuration auditing utility for a specific product ('Clawdbot') rather than logic aligned to the advertised prompt-defense skill. This scope mismatch is dangerous because users may install a prompt-security skill expecting passive detection, while the code inspects local system state and can influence operational decisions unrelated to prompt-injection defense.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code reads and evaluates /etc/ssh/sshd_config, which is unrelated to a prompt-guard skill’s stated purpose and reaches into broader host security posture. In agent/tooling contexts, this kind of unjustified host inspection expands trust and may prompt privileged execution or disclosure of sensitive system configuration beyond what users expected.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The auto-fix routine performs os.chmod on local paths based on generated fix strings, enabling the skill to modify filesystem permissions. For a prompt-defense skill, unexpected write-capable behavior is high risk because it crosses from analysis into system mutation, which could disrupt access controls or be abused in privileged execution environments.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The engine initializes an external API client and fetches remote patterns by default, which contradicts the expected behavior of a local defensive scanner. In a security skill, hidden or default-on network access expands the trust boundary, can transmit sensitive prompts or metadata off-box, and creates a supply-chain risk because detection logic can be altered remotely.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code can report detection results to an external service, which exceeds passive local scanning and may disclose analyzed content, findings, and context. Because this component processes potentially sensitive prompts, automatic reporting can leak proprietary data, secrets, or user content to third parties.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The comment says the API client is off by default, but the runtime logic enables it unless configuration or environment disables it. This misleading documentation can cause operators to deploy the skill under a false assumption that it is offline, increasing the chance of unintended data egress.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The default configuration explicitly enables the API and references a built-in beta key assumption while nearby comments claim the feature is off by default. For a security product, this mismatch is especially dangerous because users may unknowingly send sensitive prompts to a remote service under implicit credentials.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This script performs host security auditing and optional local remediation, which does not align with a prompt-guard skill whose stated purpose is prompt-injection and agent-safety pattern detection. Capability mismatch is dangerous because users may install or trust the skill for one purpose while it silently inspects unrelated local configuration and encourages broader host access than necessary.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The SSH and Telegram configuration audits reach into host and service settings unrelated to the advertised prompt-guard capability. In an agent skill context, unnecessary access to system configuration expands the trust boundary and can normalize privileged inspection of local services without a clear functional need.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The auto-fix routine can change filesystem permissions on local paths via os.chmod, moving the script from passive auditing into state-changing behavior. In a skill presented as prompt-defense tooling, this is especially risky because users may not expect local modifications, and any future expansion of issue data or fix strings could increase the chance of unintended or abusive file permission changes.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The analyzer automatically transmits metadata about HIGH/CRITICAL detections to an external HiveFence API, despite this file being presented as a backward-compatibility/local detection wrapper. Even though the payload is reduced to hashes and categories, it still creates undisclosed outbound network behavior, privacy/compliance risk, and a supply-chain trust boundary that users may not expect from a defensive scanning component.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The top-level docstring says this module exists only for backward compatibility and re-exporting, but the file actually embeds a large standalone detection engine, CLI, local logging, and remote reporting logic. This mismatch can mislead reviewers and operators into trusting the file as a thin shim while it performs materially broader actions, including filesystem writes and network egress.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: report_threat() sends threat metadata and optional caller-provided context to an external API without any built-in consent gate, redaction, or allowlist on what may be included in context. In a security tool, detected prompts or surrounding context can contain sensitive user inputs, secrets, or internal data, so this creates a real data exfiltration/privacy risk if callers pass raw content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The architecture says the API is enabled by default with a built-in beta key, but the main overview/config narrative does not prominently warn that this causes automatic outbound network activity. For a defensive security skill, silent default egress changes the trust model and can expose deployments to privacy, compliance, and supply-chain risks even if no raw prompts are intentionally sent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README advertises automatic API use with a built-in beta key and 'zero setup' operation, but does not provide a prominent upfront warning that the tool may perform network access on startup. In security-sensitive environments, unexpected outbound connections can violate policy, surprise users, and increase supply-chain and privacy risk even if only pattern metadata is fetched.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Enabling an optional API by default with a built-in beta key, without a clear privacy warning, creates a supply-chain and data-governance risk. Users may unknowingly send sensitive prompts, secrets, or security findings to a third party simply by following the documented quick-start path.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The configuration block shows the API enabled by default and mentions a built-in beta key, but omits a prominent warning about network transmission and privacy impact. In a security-focused skill, hidden or underexplained outbound communication materially increases operational risk and may violate deployment expectations.

VirusTotal

66/66 vendors flagged this skill as clean.