Prompt Architect Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

This prompt-engineering skill is mostly documentation-based, but it asks for shell execution and includes unrelated network troubleshooting instructions that users would not reasonably expect.

Review before installing. The core prompt-design content appears usable, but the skill should not need broad shell access or network diagnostics. Install only if you are comfortable with `exec` being available to the agent, or prefer a version that removes `exec` and replaces ping/firewall/proxy troubleshooting with ordinary input clarification.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Overprivileged Shell Execution Capability for a Documentation-Only Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5; related execution guidance at lines 286 and 347
Vulnerability Type: Excessive tool permissions and unnecessary network diagnostics
Risk Level: Medium

Complete Vulnerable Code Snippet (line 5):

yaml

allowed-tools: read exec

Related Guidance (English translation of line 286):

text

If required input parameters are missing, ask the user to provide them, then execute a ping command to test network connectivity, inspect firewall and proxy settings, and rerun the command.

Related Configuration Description (English translation of line 347):

text

Classification: MD+EXEC — a Markdown-based instruction Skill for which some advanced functions require exec to run validation scripts.

Technical Analysis

The Skill primarily performs text transformations: generating prompt templates, decomposing tasks, recommending Agent-loop patterns, and defining output schemas. These operations do not inherently require unrestricted operating-system command execution.

Declaring exec as an allowed tool violates the principle of least privilege by exposing a general-purpose command-execution channel to a documentation-oriented Skill. The missing-parameter error path compounds this issue by recommending ping, firewall inspection, and proxy inspection even though absent prompt parameters are not a network-connectivity problem.

On an Agent platform that honors allowed-tools, instructions derived from this Skill or attacker-controlled user input could cause commands to run with the permissions of the Agent process. The package does not contain an explicit malicious command, persistence mechanism, credential-stealing routine, or exfiltration endpoint; therefore, exploitation depends on the surrounding Agent accepting or generating an unsafe command.

Attack Path

1. An Agent loads SKILL.md and grants the Skill access to the declared ...[truncated 1263 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from allowed-tools and retain only the minimum tool access required for reading Skill documentation:

   yaml

   allowed-tools: read
   

2. Replace the missing-parameter error path with a non-executable response that only identifies and requests the absent fields.
3. Do not run network diagnostics for input-validation failures. Network tests should be reserved for a distinct, explicit troubleshooting workflow initiated or approved by the user.
4. If schema validation genuinely requires execution, expose a narrowly scoped validation tool rather than a general shell. The tool should accept structured JSON and a schema, prohibit arbitrary command arguments, and run without network access.
5. Run any unavoidable validator in a sandbox with a read-only filesystem, no inherited secrets, no shell expansion, strict CPU and memory limits, and no outbound network access.
6. Require explicit user confirmation before host or network diagnostics and maintain an allowlist of permitted diagnostic operations.
7. Add automated policy checks that reject documentation-only Skills declaring general-purpose execution permissions without a documented and technically necessary use case.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill declares exec capability while presenting itself as a lightweight prompt-engineering tool, and the description does not warn users that commands may be run. Hidden or poorly disclosed execution capability increases the chance of unexpected local command execution under a misleadingly harmless description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a prompt-engineering/template tool, but its error-handling section instructs the agent to execute network diagnostics such as ping and to inspect firewall/proxy settings. That behavior is unrelated to the declared purpose and can cause unexpected command execution and network activity in environments where users would not anticipate it.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented suggestion to run ping introduces shell/network behavior that is not justified by a prompt-architecture assistant's scope. Even a simple diagnostic command can leak environment details, encourage lateral troubleshooting behavior, and normalize use of exec in contexts where no execution should be needed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The text recommends a network diagnostic command without any warning that using the skill may trigger command execution or network access. In a prompt-design skill, this mismatch is especially dangerous because users are unlikely to expect operational actions affecting the host or network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file explicitly says the skill was redesigned as a Chinese professional prompt-engineering tool and removed prior non-Chinese text. There is no opt-in choice for language or explanation that the Chinese-only constraint is required for a region-specific use case, which may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger section says to use the skill whenever users need project management, task planning, progress tracking, or team collaboration. Those are broad everyday work contexts rather than specific invocation phrases or constrained conditions, so the skill could be activated for many unrelated requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is entirely written in Chinese and presents all examples and instructions in that language without any indication that language choice is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

md

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

## 适用场景
### 场景一：构建退款客服 Agent 的 System Prompt

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Several capability sections say processing should '遵循单一意图原则' (for example L117, L163, L213, L244), indicating a narrow prompt-engineering intent. Line L421 instead declares the skill should be used for project management, task planning, progress tracking, and team collaboration, which contradicts that documented narrow intent and expands it into a broader workflow-management role.

Content

No source excerpt is available for this finding.