prompt-optimizer

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 2:59 AM UTC
• Version: 4.1.2

Overview

This prompt-rewriting skill has proportionate, disclosed behavior, with minor activation ambiguity and optional template downloads outside this review.

Use an explicit command naming prompt optimization and review each rewritten prompt before accepting it. Settings and activation state may persist locally. The package works through its LLM-only fallback without templates; optional GitHub libraries were not assessed here and should be reviewed before adding them. Smaller categories reduce context use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md

| State Persistence | ⚠️ In-conversation only; lost on restart |
| Quality Evaluation | ✅ |

**Install:** Copy skill folder into your project. Add to `CLAUDE.md`: `Read and follow skills/prompt-optimizer/SKILL.md`
**Recommended Mode:** Template-first (default), in-conversation state memory.
**Limitation:** Must re-enable ("enable prompt optimizer") each new conversation.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

md

| State Persistence | ❌ No cross-session persistence |
| Quality Evaluation | ✅ |

**Install:** Copy skill folder into project root. Add to `.cursorrules`: `Read and follow skills/prompt-optimizer/SKILL.md. Activate when user says "enable prompt optimizer".`
**Recommended Mode:** Template-first (default).
**Limitation:** Must re-enable each session; manual file copy required.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 156)May include surrounding context.

|--------|---------| | Enable | "enable prompt optimizer" / "开启提示词优化" | | Enable (Full) | "enable full version" / "开启完整版提示词优化" | | Disable | "disable prompt optimizer" / "关闭提示词优化" |

Minimal usage:

text

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · STANDALONE.md (reported line 231)May include surrounding context.

md

| File | Size | Best For |
|------|------|----------|
| `prompt_library_lite.json` | 3.0 MB | Broad coverage, fast |
| `prompt_library_full.json` | 9.9 MB | Maximum quality, no truncation |

The AI auto-selects based on task complexity.

The activation phrase "enable full version" does not identify the prompt optimizer and can collide with requests about other products or features.

Low

• Category: Trigger Abuse
• Confidence: 90% confidence

Finding

The generic activation phrase "enable full version" can enable the optimizer when the user is referring to an unrelated product, violating the skill's explicit opt-in boundary. This could cause unintended prompt rewriting or template loading, although the documented confirmation step limits downstream impact.

Content

No source excerpt is available for this finding.