Promptify Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:03 AM UTC
• Version: 3.1.0

Overview

Promptify is mostly a coherent prompt-optimization skill, but it includes unsafe clipboard command generation and broad codebase/web access triggers that users should review before installing.

Review this skill before installing. Avoid running generated `echo 'PROMPT' | pbcopy` commands, especially for prompts containing quotes or shell-like text. Use the codebase and web modifiers only when you are comfortable with local project context being read or prompt details being used for web research, and prefer a version-pinned installer if available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:63

Finding

Command Injection Through Unsafe Clipboard Command Generation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:63-67; duplicated in commands/promptify.md:52-56
Vulnerability Type: Shell command injection through unsafe interpolation of prompt-derived content
Risk Level: High

Vulnerable Code (SKILL.md:63-67):

markdown

## Output

1. Optimized prompt in code block
2. `echo 'PROMPT' | pbcopy`
3. 2-3 sentence explanation

Vulnerable Code (commands/promptify.md:52-56):

markdown

## Output

1. Optimized prompt in code block
2. `echo 'PROMPT' | pbcopy`
3. 2-3 sentence explanation

Technical Analysis

The Skill instructs the agent to place the optimized prompt inside a single-quoted shell command. The prompt originates from user-controlled content, but neither instruction defines a shell-escaping, encoding, or validation mechanism.

A single quote in the generated prompt can terminate the intended shell string. Subsequent metacharacters can then introduce additional shell commands. Although the Skill does not execute the command itself, it presents the command as part of the expected output, making exploitation possible if a user copies and runs it.

Attack Path

1. An attacker supplies prompt text containing a single quote followed by shell syntax.
2. Promptify optimizes the text and inserts it into the prescribed echo 'PROMPT' | pbcopy command.
3. The generated command contains attacker-controlled syntax outside the intended quoted argument.
4. The user copies and executes the command as instructed.
5. The local shell interprets the injected syntax and executes it with the user's privileges.

Impact Assessment

Successful exploitation could execute arbitrary shell commands under the account of the user who runs the generated command. The resulting scope could include reading or modifying files accessible to that user, accessing environment variables and credentials, invoking network utilities, or installing user-level p ...[truncated 139 chars]

Remediation

View remediation

Remediation Suggestions

• Do not generate executable shell commands containing prompt-derived content.
• Return the optimized prompt as plain text and direct users to copy it through their interface.
• If clipboard integration is required, use a trusted platform API that accepts data without shell parsing.
• If a shell command is unavoidable, apply a well-tested, shell-specific argument-escaping routine rather than manually adding quotes.
• Consider passing encoded content to a fixed decoder through standard input, with no user-controlled content placed in executable shell syntax.
• Add regression tests covering single quotes, command substitutions, newlines, shell metacharacters, and multiline prompts.
• Apply the same correction to both SKILL.md and commands/promptify.md to prevent inconsistent behavior.

T08 · Insecure Dependencies

Warning

• Location: README.md:14

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md:14-17
Vulnerability Type: Unsafe dependency retrieval and execution
Risk Level: Medium

Vulnerable Code:

markdown

**Molt.bot:**
```bash
npx molthub install promptify

text

### Technical Analysis

The installation instructions invoke `molthub` through `npx` without specifying an exact package version or integrity value. Depending on the local package-manager state and registry configuration, `npx` may download and execute the currently resolved package from a remote registry.

Because the resolved artifact is mutable and is not pinned or independently verified, the effective installation code can change after this Skill has been audited. A compromised publisher account, package takeover, registry compromise, or malicious future release could therefore cause users to execute unreviewed code.

### Attack Path

1. An attacker compromises the `molthub` package, its publisher account, or its distribution channel.
2. A malicious package version is published or served through the configured registry.
3. A user follows the documented command `npx molthub install promptify`.
4. `npx` resolves and retrieves the mutable package version.
5. The package CLI or applicable lifecycle code executes on the user's system.
6. Malicious code runs with the privileges of the user performing the installation.

### Impact Assessment

A compromised dependency could execute arbitrary code with the installing user's privileges. Potential scope includes theft or modification of user-accessible files, credentials, source code, and configuration; network access; modification of the installed Skill; and establishment of user-level persistence. This finding does not demonstrate that the current `molthub` package is malicious; the risk arises from executing an unpinned and unverified remote dependency.

Remediation

View remediation

Remediation Suggestions

• Pin the package to a reviewed exact version rather than allowing mutable resolution.
• Document the canonical registry, package publisher, and expected package identity.
• Publish and verify integrity hashes or signed release artifacts where supported.
• Review installation-time scripts and CLI behavior before recommending the package.
• Prefer an installation process backed by a lockfile or another reproducible dependency mechanism.
• Document how users can verify the downloaded artifact before execution.
• Establish an update process in which new package versions are reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to execute a remote package via npx molthub install promptify without pinning a specific version. This creates a supply-chain risk because users may unknowingly install a newly published or compromised version, and the command is especially risky in a tool-installation context where users are likely to copy-paste it directly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises image analysis, use of conversation context, web search, and clipboard copying, but does not clearly warn users about the privacy and data-handling implications of those features. In a prompt-optimization skill, these capabilities can expose sensitive prompts, screenshots, repository details, or clipboard contents to unintended processing or external services if users are not explicitly informed and asked for consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The auto-detection example uses the vague phrase 'Help me with this thing' to trigger clarifying-question behavior, indicating broad intent matching on everyday language. In an agent skill, overly broad triggers can cause accidental invocation and unintended access to context, codebase inspection, or other sub-agent behaviors when the user did not explicitly request them.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description uses broad natural-language triggers like 'make this clearer' and 'provides vague/unstructured prompts,' which can match ordinary conversation outside the user's intent to invoke this skill. This increases the chance of unintended activation, causing the agent to route into prompt-optimization behavior, potentially reshaping user requests or launching sub-agents when not explicitly desired.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The auto-detection signals are ambiguous and high-frequency phrases like 'best practices,' 'latest,' 'this project,' or 'make it better' can appear in many benign requests. Because the skill can dispatch clarifier, codebase, or web-research sub-agents based on these loose heuristics, accidental invocation may broaden data access or external lookups beyond what the user expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad natural-language phrases like references to 'this project', 'our API', 'integrate', and 'refactor', which are common in ordinary user requests. In a prompt-optimization skill, this can cause unintended activation of the codebase-research sub-agent on prompts that only mention software context superficially, leading to unnecessary codebase access and over-collection of contextual information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to activate web research for many common prompt-improvement requests that merely mention frameworks, APIs, or terms like 'best practices' and 'latest'. This can cause unnecessary external lookups, increasing the chance of data exposure to web tools and reducing predictability of agent behavior, though the content itself is not directly malicious.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description uses modifier-style trigger language ("+ask +deep +web <- modifiers") without clearly constraining when the skill should activate or when those modifiers are appropriate. In an agent environment, ambiguous activation scope can cause the skill to be invoked unintentionally and route the agent into broader behaviors like web search or codebase exploration than the user expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs codebase exploration and web search but provides no warning, consent gate, or sanitization guidance for sensitive data. This increases the risk that proprietary code, internal filenames, prompts, secrets, or user-provided confidential context could be unnecessarily accessed, summarized, or transmitted to external services during prompt optimization.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.