Promptify Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:03 AM UTC
• Version: 3.1.0

Overview

Promptify is a coherent prompt-optimization skill, but it needs review because it can broaden into codebase or web research and includes an unsafe clipboard shell-command pattern.

Review before installing. Use it only if you are comfortable with prompt optimization that may read relevant project files, use web tools for current information, and overwrite the clipboard. Avoid executing generated `echo '...' | pbcopy` commands for prompts containing untrusted or complex text, and prefer a pinned or verified installer path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:14

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md:14-17
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

**Molt.bot:**
```bash
npx molthub install promptify

text

### Technical Analysis

The documented installation procedure invokes `npx molthub` without specifying an exact package version or validating an integrity hash. Depending on the local package state and npm configuration, `npx` can download the latest available version of the named package and execute its entry point with the privileges of the user performing the installation.

Because the effective executable is mutable after this project has been reviewed, a future compromised release, registry-account takeover, or malicious package replacement could alter installation behavior without requiring any change to this repository. The repository does not provide a lockfile, checksum, signature, or other mechanism for verifying which `molthub` package release is executed.

### Attack Path

1. An attacker compromises the package publisher account, package distribution channel, or a subsequently published package version.
2. The attacker publishes a modified `molthub` package containing malicious installation behavior.
3. A user follows the documented `npx molthub install promptify` command.
4. `npx` retrieves the mutable package version from the configured registry.
5. The package executes locally with the installing user's privileges.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope could include reading or modifying files accessible to that user, accessing environment variables and development credentials, changing project files, or installing additional user-level components. This instruction does not itself grant administrative privileges; impact is bounded by the privileges and environ
...[truncated 37 chars]

Remediation

View remediation

Remediation Suggestions

• Pin molthub to a reviewed, exact version instead of implicitly executing the latest release.
• Publish and verify package integrity information, such as an npm lockfile integrity value, trusted checksum, or signed release provenance.
• Document the expected package registry and advise users not to use untrusted registry mirrors.
• Prefer installing an audited version before invocation rather than combining remote retrieval and immediate execution.
• Establish a release-review and dependency-update process so that version changes are explicitly assessed before documentation is updated.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:64

Finding

Shell Command Injection Through Unsafe Prompt Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:64-67 and commands/promptify.md:53-56
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code Snippet from SKILL.md:

markdown

## Output

1. Optimized prompt in code block
2. `echo 'PROMPT' | pbcopy`
3. 2-3 sentence explanation

Vulnerable Code Snippet from commands/promptify.md:

markdown

## Output

1. Optimized prompt in code block
2. `echo 'PROMPT' | pbcopy`
3. 2-3 sentence explanation

Technical Analysis

Both instruction files require the generated prompt to be embedded in a single-quoted shell command. The prompt is derived from user-controlled content, but the Skill defines no escaping, validation, or safe serialization procedure.

A single quote within the generated prompt can terminate the intended shell string. Subsequent shell metacharacters—such as semicolons, pipelines, command substitutions, or redirections—can then be interpreted as shell syntax rather than clipboard data. For example, content shaped like '; attacker_command; echo ' could transform the generated output into multiple shell commands if a user or an automated agent executes it.

The issue is not caused by pbcopy itself. It results from constructing executable shell text through direct interpolation of untrusted prompt content.

Attack Path

1. An attacker supplies prompt content containing a single quote followed by shell syntax.
2. Promptify optimizes the content while preserving or reproducing the malicious characters.
3. Following its output contract, the Skill places that content into echo 'PROMPT' | pbcopy.
4. The generated command is copied and executed by the user or passed to a shell by an automation workflow.
5. The injected syntax escapes the intended quoted argument and executes commands with the invoking user's privileges.

Exploitation requires the generated command to be executed; merely di ...[truncated 612 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the requirement to generate an executable shell command containing user-controlled prompt text.
• Use a trusted clipboard API or native tool integration that accepts the prompt as data without passing it through a command shell.
• If a command-line workflow is unavoidable, write the content to standard input through a mechanism that does not perform shell interpolation.
• Apply robust, platform-specific argument encoding rather than manually surrounding content with single quotes.
• Avoid echo for arbitrary data because option parsing, escape handling, and newline behavior vary between shell implementations.
• Clearly label any example command as non-executable unless it has been safely generated.
• Add tests covering single quotes, command substitutions, semicolons, pipelines, redirections, backticks, multiline prompts, and shell-specific metacharacters.
• Apply the same remediation to both SKILL.md and commands/promptify.md to prevent inconsistent behavior between invocation paths.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README advertises +deep codebase exploration and +web search behaviors without warning that these actions may inspect repository contents or send data to external services. In a prompt-optimization skill, this is especially risky because users may invoke it casually and not realize their prompt or surrounding context could be shared or used to drive broader data access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The auto-detection example includes the broad phrase "Help me with this thing," which overlaps heavily with normal conversation and can trigger the skill unexpectedly. In an agent environment, overbroad triggering can cause unintended prompt transformation, routing to sub-agents, or context exposure when the user did not explicitly request this behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description includes broad activation examples like "make this clearer" and also claims it should be used when users provide vague or unstructured prompts. Those signals are common in normal conversation and can cause the skill to trigger when the user did not explicitly request prompt optimization, leading to unintended routing to sub-agents or prompt transformation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to activate on many normal requests involving an existing codebase, such as references to 'this project' or common verbs like 'integrate' and 'refactor'. That can cause the agent to perform unnecessary codebase exploration and expand data access beyond what the user explicitly asked for, increasing the chance of oversharing repository context into downstream prompt optimization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to activate web research for many ordinary prompts that merely mention 'best practices', 'latest', or a framework name. In an agent system with tool access, this can cause unintended external browsing, unnecessary data disclosure to third-party services, and expansion of the prompt’s scope beyond the user’s likely intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger section says the skill applies to ambiguous requirements such as "make it better" and "fix this thing," plus vague pronouns like "this" and "it." These are very common phrases in normal user requests, and the file does not define clear boundaries or exclusion conditions for when the clarifier should not activate, creating some risk of over-triggering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to pipe generated content to pbcopy, which writes to the system clipboard without an explicit user confirmation or warning. While this is not inherently malicious, clipboard writes can overwrite the user's current clipboard contents and may unexpectedly place sensitive or misleading text into a channel the user may later paste elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.