prompt-injection-guard

• Outcome: Malicious
• Latest audit: Oct 17, 2026 · 2:03 AM UTC
• Version: 1.0.1

Overview

This looks like a purpose-aligned static security scanner, but its security posture is unreliable and partly misleading.

Treat this as a review-needed security utility, not a trusted guardrail. Before installing or using it in automation, require fixes for the broken CLI import, accurate filesystem permissions, truthful verification claims, and badges that clearly show FAIL/UNSAFE when risks are detected.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

YARA rule 'crypto_miner_software': References to known cryptocurrency mining software [cryptominers]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched cryptocurrency mining indicators (stratum protocol, mining pools, miner binaries, or cryptojacking scripts).

Content

Scanner excerpt · scripts/prompt_guard.py (reported line 29)May include surrounding context.

python

?key|BEGIN [A-Z ]*PRIVATE KEY",
    ],
    "destructive_command": [
        r"(?i)rm\s+-rf\s*/|rm\s+-rf\s+~\s*$",
        r"(?i)DROP TABLE|DROP DATABASE",
        r"(?i)mkfs|dd\s+if=.*of=/dev/",
    ],
    "data_exfiltration": [
        r"(?i)curl\s+[^|]*\s+-d\s|curl\s+.*\|.*sh",
        r"(?i)~\/(\.ssh|\.aws|\.gnupg|\.git)",
        r"(?i)rev(erse)?[- ]?shell",
    ],
    "crypto_mining": [r"(?i)xmrig|coinhive|minerd|cpuminer|stratum\+tcp"],
    "privilege_escalation": [
        r"(?i)sudo\s+rm|chmod\s+777|chown\s+root",
        r"(?i)useradd\s+-o|passwd\s+-?\w*\s+root",
    ],
    "persistence": [
        r"(?i)crontab|@reboot|authorized_keys",
        r"(?i)\.bashrc|rc\.local|systemctl\s+enable",
    ],
    "obfuscation": [
        r"(?i)base64\s*-d\s*\||base64\s*--decode\s*\|",
        r"(?i)eval\(\$\(|compile\(.*exec\(|__import__\(['\"]os",
    ],
}

def scan(text):
    hits = []
    for cat, pats in THREATS.items():
        for p in pats:
            for m in re.finditer(p, text)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

3. Output SAFE / MACH / TOTAL scores and verdict (TOTAL ≥ 60 = PASS); `--badge out.svg` emits an LGD SAFE SVG; FAIL → exit 1 (fail-closed).

### Safety boundary
- Static analysis only; never auto-executes external commands.
- On risk detection → FAIL; human decides.
- Does not delete / modify / publish anything.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module claims a fail-closed prompt-injection guard, but the implementation only performs heuristic scoring and emits PASS/FAIL output; it does not actually enforce blocking, quarantine, or default-deny behavior. In a security skill, this mismatch can cause downstream users or automation to trust the tool as a protective control when malicious content may still be accepted or only lightly penalized.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level natural-language documentation is written in Chinese and presents the skill description and usage in that language only. For a general-purpose scanning script, this imposes a language preference without opt-in or an explained region-specific requirement, which matches the locale-policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The badge renderer always displays the label 'SAFE' in green, even when the computed verdict is FAIL or threat hits are present. This can mislead users, CI dashboards, or reviewers into treating flagged content as approved, undermining the security value of the scanner and enabling unsafe content to pass social or process checks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The AGENTS.md purpose and invocation describe a fail-closed prompt-injection scanner and its behavior, but the provided file itself is only documentation and contains no code implementing those operations. This is a description-behavior mismatch within the analyzed artifact because the claimed operational behavior cannot be observed here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest sets the category to a Chinese-only label (安全), and the document includes mandatory bilingual/Chinese presentation without any stated user opt-in or language preference mechanism. This can violate a language/locale policy when a skill imposes a specific language presentation rather than offering a choice.

Content

No source excerpt is available for this finding.

Static analysis

Detected: malicious.crypto_mining

Possible crypto mining behavior detected.

Critical

• Code: malicious.crypto_mining
• Location: scripts/prompt_guard.py:29