Security audit

Prompt Dog

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese prompt/workflow design skill with a disclosed contract-review example package, and I found no hidden code execution, exfiltration, persistence, or deceptive behavior.

Install this only if you want a Chinese-language prompt/workflow design assistant and understand that the included contract-review asset handles sensitive legal documents. Use脱敏/test contracts first, confirm your platform's data handling rules, and treat all legal outputs as lawyer-review work product, not final advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file introduces operational startup instructions for a separate contract-review agent inside the prompt-dog skill context, creating cross-skill scope confusion and unintended capability expansion. In an agent system that routes by skill metadata, this can cause the wrong workflow to activate, pull unrelated files, or execute review procedures outside the user’s intended task, increasing the risk of prompt injection, data exposure, and unsafe automation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file defines a full commercial contract review agent, including legal risk analysis, law-source checking, iterative review loops, and deliverable generation, which is materially outside the declared purpose of the parent skill as a prompt/SOP design expert. This kind of scope drift is dangerous because it can cause an unrelated skill to silently perform high-stakes legal-analysis tasks under the wrong trust boundary, bypassing expected routing, oversight, and domain-specific safeguards.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These lines instruct the agent to extract legal facts, identify legal risks, provide clause revisions, and perform source retrieval for laws and cases, despite the enclosing skill being described as a prompt/workflow architect rather than a legal-analysis system. That mismatch increases the chance that users or orchestrators invoke a non-legal skill for regulated legal-review work, leading to unauthorized advice generation, hallucinated authority, or reliance on outputs without the controls expected for legal tooling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file presents the skill's setup and operating instructions solely in Chinese, including all trigger examples and expected interactions. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which this document does not provide.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says this skill should use multiple-choice clarification with recommended defaults throughout, and specifically forbids consecutive open-ended questioning. However, the quickstart says that for a request to write a new prompt, the correct behavior is to 'not ask follow-up questions' and directly provide a complete prompt. That documented expectation conflicts with the stated skill workflow of clarifying needs via structured choices before delivery.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill description, title, slogan, and primary interaction example are presented entirely in Chinese, including the prescribed user reply "都按推荐" as part of the core workflow. There is no indication that users may interact in other languages or that the Chinese-only presentation is a necessary regional constraint, which can violate language/locale choice policy.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s activation criteria are extremely broad: it should trigger for vague requests about prompts, workflows, unstable AI behavior, and even single-sentence ambiguous needs. This can cause inappropriate interception of general-purpose conversations, overriding more suitable skills or direct answers and increasing the chance of user-confusion, misrouting, or policy-bypassing through unnecessary workflow construction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill mandates a fixed language behavior ('说用户的语言') and prescribes a rigid interaction style without explicit user opt-in. While not directly dangerous, enforced communication behavior can conflict with user preferences, platform defaults, or accessibility/compliance expectations, especially in multilingual or regulated contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The eval prompt and expected output explicitly require Chinese-language behavior, and the file provides no indication that language selection is optional or user-configurable. This can violate locale/language policy because it embeds a fixed language constraint in natural-language content rather than offering user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file title and all template field values are written in Chinese, and the skill path also indicates a contract-review agent using Chinese-language templates. There is no natural-language indication that users may choose another language or that the Chinese-only format is a documented, region-specific requirement, which creates a language/locale policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The interaction pattern in this file directs the agent to execute a predefined review workflow without the multiple-choice clarification guardrails required by the parent skill. That mismatch weakens the skill’s control model and can lead to ambiguous user intent being interpreted as authorization to review files, batch process documents, or write outputs without the expected narrowing questions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow includes document export and production of external-facing legal-review deliverables such as review reports, annotations, and structured risk lists, which extends beyond merely designing prompts or SOPs. Even with some cautions about lawyer confirmation, embedding deliverable-generation capability in the wrong skill can facilitate accidental external use of legal work product produced without appropriate domain segregation, review, or access controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill hard-codes a language assumption ('报告语言为中文') from conversation language rather than explicitly confirming the user's desired output language. This can cause silent misconfiguration, especially in multilingual or delegated-work contexts, leading to incorrect deliverables or downstream workflow errors.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file is entirely written in Chinese and does not offer a language-selection path or document a required locale constraint. In a prompt-engineering skill intended for broad use, this can cause misrouting, misunderstanding of instructions, or exclusion of users and downstream agents that operate in other languages, reducing reliability and potentially causing incorrect task execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill content is written to operate entirely in Chinese and does not provide a language-selection path or justify a locale restriction. This can cause users or downstream agents to miss important instructions, confirmations, or safety-relevant nuances if they are not Chinese speakers, increasing the chance of misuse, misunderstanding, or failed validation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction requires deliverables to end with a specific Chinese sentence and forbids certain wording patterns, which imposes a fixed language/locale style on all outputs. The file does not indicate that this is optional, user-selected, or justified as a region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is entirely written in Chinese and appears to assume Chinese-language operation without offering a user language choice or documenting a locale constraint. In a general-purpose agent skill, this can cause misinterpretation of requirements, inaccessible safety/verification steps for non-Chinese users, and degraded oversight because critical validation instructions may not be understood.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file is natural-language setup documentation and all user-facing instructions are written in Chinese. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy violation, and the file does not indicate that Chinese is optional or that other language variants are available.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Line L61 instructs the skill to 'speak the user's language' as a fixed policy. This is a natural-language locale policy constraint, and the file does not indicate that the user may choose a different language or opt out of this behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 该 markdown 文件通篇以中文呈现，且未声明可选语言、翻译方式或该中文限定的业务/区域必要性。按照语言/locale 政策，若技能内容隐含强制特定语言而无用户选择或明确合理说明，应视为自然语言策略违规。
Content: No source excerpt is available for this finding.