Security audit

prompt-leak-scanner

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a local prompt-leak checker; the scary prompt-injection phrases are detection examples, not instructions for the agent to follow.

Install only if you are comfortable running a local Python scanner over prompt text or files you choose. Be aware that its documentation has argument mismatches, and the manifest lists broader agent tools than the current script needs; prefer invoking the script directly with --text or --file and avoid granting unnecessary WebFetch or Write access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · README.md (reported line 7)May include surrounding context.
md
## English Pre-share scanner for prompts and system prompts: secrets, internal paths, PII, custom sensitive words (--extra), and self-leak backdoors ('ignore previous instructions' / 'print your system prompt' plants). Non-zero exit blocks leaks. **Pain point**: Prompts are the most casually shared sensitive asset: one embedded key, intranet path, or 'repeat your system prompt' plant gives away the farm — nobody runs a pre-release check.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · README.md (reported line 7)May include surrounding context.
md
## English Pre-share scanner for prompts and system prompts: secrets, internal paths, PII, custom sensitive words (--extra), and self-leak backdoors ('ignore previous instructions' / 'print your system prompt' plants). Non-zero exit blocks leaks. **Pain point**: Prompts are the most casually shared sensitive asset: one embedded key, intranet path, or 'repeat your system prompt' plant gives away the farm — nobody runs a pre-release check.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · README.md (reported line 7)May include surrounding context.
md
# 提示词泄漏扫描器 / Prompt Leak Scanner [![LGD](https://img.shields.io/badge/LGD-Governance-blue)](https://github.com/zhaoxinghua09-cell/lgd-theory) ## English Pre-share scanner for prompts and system prompts: secrets, internal paths, PII, custom sensitive words (--extra), and self-leak backdoors ('ignore previous instructions' / 'print your system prompt' plants). Non-zero exit blocks leaks. **Pain point**: Prompts are the most casually shared sensitive asset: one embedded key, intranet path, or 'repeat your system prompt' plant gives away the farm — nobody runs a pre-release check. LGD-III gated (the last gate before a prompt goes public). Part of the **LGD governance family** (凡自治之物: registered / evidenced / gated). Zero-dependency (stdlib only). See `scripts/` for

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Line L03 uses Chinese for the operational instruction and does not indicate that other languages are supported or that this locale restriction is intentional for a region-specific use case. That can violate language/locale policy by forcing a specific language context on users or agents without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring, CLI description, help text, and output messages are all written exclusively in Chinese. For a general-purpose prompt leak scanner, this is a natural-language policy concern because the file imposes a specific language without any visible opt-in, alternative locale, or justification that it is region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The inline instruction at L39 states the agent must not execute remote write operations such as git push or remote publishing. In this file, however, there is no implementation at all—only documentation—so there is no direct contradiction between comments and code behavior to substantiate a stronger finding. Because the file is purely descriptive and contains no executable logic, this is at most a very weak documentation-to-implementation gap.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The document is written in both Chinese and English and appears to assume these languages as the presentation format without stating any user language preference or opt-in mechanism. Under the policy rule, forcing a specific language or locale without user choice can be a natural-language policy concern unless clearly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation states scanning occurs on the provided prompt text 'in memory', but it also documents an optional --check_cache mode that inspects __pycache__, which expands scope from user-supplied text to local filesystem artifacts. This mismatch can mislead operators about what data may be read during execution, weakening consent, review, and least-surprise expectations in a security-sensitive scanning tool.
Content: No source excerpt is available for this finding.