prompt-leak-scanner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:42 PM UTC
• Version: 1.0.0

Overview

This local prompt scanner mostly matches its stated purpose, but its unverified global install instructions and sensitive output handling warrant review before installation.

Install only from a pinned, reviewed commit or verified release, avoid the global npx path unless you trust the installer, and treat scanner output as sensitive because it can include parts of the secrets or terms it finds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:78
• Finding: Unpinned Package Execution Through Global npx Installation## Vulnerability Details **File Location**: `SKILL.md:78` **Vulnerability Type**: Supply-chain exposure through an unpinned package installer **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The installation instructions invoke the mutable `skills` package through `npx` without specifying an audited version or integrity digest. If the package is not already available locally, `npx` can retrieve it from the configured package registry and execute its package entry point. The `-g` option also requests a global Skill installation, expanding the resulting changes beyond the current project. The command therefore delegates code execution and global installation behavior to an unpinned third-party dependency whose contents may change after this Skill has been reviewed. This behavior is not required for the scanner's core functionality. The scanner itself is a standard-library Python script and can run locally without a third-party runtime dependency. ### Attack Path 1. An attacker compromises the registry package, its publisher account, or another component in the package resolution path. 2. The attacker publishes a malicious version that remains compatible with the unpinned package name. 3. A user follows the documented `npx skills add ... -g` instruction. 4. `npx` resolves and downloads the attacker-controlled version. 5. The package executes with the privileges of the invoking user and performs global installation operations. 6. The malicious package can modify user-accessible files, install altered Skills, read data available to that user, or influence subsequent Agent sessions. ### Impact Assessment Successful exploitation provides code execution with the invoking user's operating-system privileges. The global installation option can affect the user's shared Agent environment rather than only the audited project. It does not independently g ...[truncated 89 chars]
• Remediation: ## Remediation Suggestions - Pin the installer to an explicitly reviewed version instead of relying on the latest registry resolution. - Publish and verify a package integrity digest or signed release. - Avoid global installation unless it is strictly necessary and explicitly authorized. - Prefer invoking a reviewed local installer with a locked dependency set. - Document the exact package source, version, expected checksum, and files the installer will modify. - Advise users not to run installation commands with elevated privileges.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81
• Finding: Mutable Remote Repository Is Copied Into a Trusted Agent Skill Directory## Vulnerability Details **File Location**: `SKILL.md:81-82` **Vulnerability Type**: Unpinned remote Skill installation **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/prompt-leak-scanner ~/.workbuddy/skills/ ``` ### Technical Analysis The manual installation procedure clones the repository's current default branch without selecting a reviewed release tag or commit hash. It then copies content from that mutable checkout directly into a trusted Agent Skill directory. Consequently, the content installed by a future user is not necessarily the content covered by this audit. A repository owner, compromised maintainer account, or attacker able to alter the remote repository could replace the Skill instructions or scripts after review. Copying the result into `~/.workbuddy/skills/` can cause the altered instructions or code to be loaded and trusted during later Agent operations. No checksum, signature, or commit verification is documented before the copy occurs. ### Attack Path 1. An attacker compromises the remote repository or a maintainer account. 2. The attacker modifies the default branch to include malicious Skill instructions or executable scripts. 3. A user follows the documented `git clone` command, retrieving the modified branch. 4. The user copies the modified Skill into `~/.workbuddy/skills/`. 5. The Agent later loads the malicious Skill or invokes its scripts as trusted local content. 6. The payload can influence Agent behavior or execute with the permissions available to the Agent process, depending on the injected content. ### Impact Assessment The immediate commands operate with the invoking user's filesystem privileges and can place mutable remote content into that user's trusted Skill directory. A substituted Skill may influence future Agent sessions and may execute code with the Agent process's permissions whe ...[truncated 126 chars]
• Remediation: ## Remediation Suggestions - Check out a specific reviewed commit hash or immutable signed release before copying files. - Publish a cryptographic checksum for the complete Skill package and require verification. - Use signed Git tags or release attestations and document signature verification. - Review the checked-out file list before installing it into a trusted Agent directory. - Copy only the required audited files rather than a mutable repository subtree. - Clearly state that the remote source must not be trusted solely because it uses HTTPS.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/prompt_leak_scanner.py:44
• Finding: Scanner Echoes Sensitive Match Fragments and Custom Sensitive Terms## Vulnerability Details **File Location**: `scripts/prompt_leak_scanner.py:44-51` **Vulnerability Type**: Plaintext sensitive data exposure in scanner output **Risk Level**: Medium ### Vulnerable Code ```python for m in pat.finditer(text): frag = m.group(0) shown = frag[:10] + "…" if len(frag) > 13 else frag hits.append({"category": name, "severity": SEVERITY[name], "pos": m.start(), "sample": shown}) for w in extra or []: for m in re.finditer(re.escape(w), text): hits.append({"category": "自定义敏感词", "severity": SEVERITY["自定义敏感词"], "pos": m.start(), "sample": w}) ``` ### Technical Analysis The scanner is intended to detect sensitive information before prompts are shared, but it includes matched content in its findings. Matches of 13 characters or fewer are retained in full. Longer matches expose their first 10 characters. Values supplied through `--extra` are always stored in full as the finding sample. These samples are subsequently printed in normal output or serialized into JSON. This creates a secondary disclosure channel. Terminal history, CI logs, build artifacts, monitoring systems, or downstream JSON processors may retain sensitive fragments that were originally confined to the scanned input. Prefixes can be security-sensitive because they may identify an account, credential type, internal project, or enable correlation with other leaked data. ### Attack Path 1. A user scans a prompt containing a credential, PII, an internal identifier, or a custom sensitive term. 2. The regular expression or custom-term search matches the sensitive value. 3. The scanner places either the complete short match, the first 10 characters, or the complete custom term into the `sample` field. 4. The command prints the finding to standard output or emits it in JSON. 5. A CI system, shell transcript, logging a ...[truncated 576 chars]
• Remediation: ## Remediation Suggestions - Do not include matched content in findings by default. - Report only the category, severity, byte or character offset, line number, and match length. - Replace the `sample` field with a constant redaction marker such as `[REDACTED]`. - Never echo values supplied through `--extra`; use an index or caller-provided non-sensitive label. - If sample display is required, make it an explicit opt-in option with a prominent warning. - Apply strong masking that does not reveal stable prefixes or suffixes. - Document that scanner output must be treated as sensitive and prevent CI systems from publishing JSON reports without access controls. - Add tests confirming that credentials, PII, and custom terms cannot appear in either text or JSON output.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Instruction Override

High

• Category: Prompt Injection

Content

# 提示词泄漏扫描器 / Prompt Leak Scanner

Pre-share scanner for prompts and system prompts: secrets, internal paths, PII, custom sensitive words (--extra), and self-leak backdoors ('ignore previous instructions' / 'print your system prompt' plants). Non-zero exit blocks leaks.

**Pain point**: Prompts are the most casually shared sensitive asset: one embedded key, intranet path, or 'repeat your system prompt' plant gives away the farm — nobody runs a pre-release check.

• Confidence: 80% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

# 提示词泄漏扫描器 / Prompt Leak Scanner

Pre-share scanner for prompts and system prompts: secrets, internal paths, PII, custom sensitive words (--extra), and self-leak backdoors ('ignore previous instructions' / 'print your system prompt' plants). Non-zero exit blocks leaks.

**Pain point**: Prompts are the most casually shared sensitive asset: one embedded key, intranet path, or 'repeat your system prompt' plant gives away the farm — nobody runs a pre-release check.

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

# 提示词泄漏扫描器 / Prompt Leak Scanner

Pre-share scanner for prompts and system prompts: secrets, internal paths, PII, custom sensitive words (--extra), and self-leak backdoors ('ignore previous instructions' / 'print your system prompt' plants). Non-zero exit blocks leaks.

**Pain point**: Prompts are the most casually shared sensitive asset: one embedded key, intranet path, or 'repeat your system prompt' plant gives away the farm — nobody runs a pre-release check.

LGD-III gated (the last gate before a prompt goes public).

Part of the **LGD moat** (凡自治之物: registered / evidenced / gated).

Zero-dependency (stdlib only). See `scripts/` for CLI usage (`

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation describes file-reading behavior and workflow usage, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, this can lead to overbroad default access or ambiguous enforcement, increasing the chance that the skill reads unintended local files when scanning prompts or related assets.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The primary display fields are all in Chinese, and the rest of the skill description is written exclusively in Chinese. This creates a language/locale constraint without any opt-in, alternative language instructions, or justification that the skill is intended only for a Chinese-speaking region or audience.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The installation instruction uses 'npx skills' without pinning a specific package version, which introduces supply-chain risk. If the upstream package changes, is compromised, or resolves unexpectedly, users may execute unreviewed code during installation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring is entirely in Chinese and presents the tool's purpose, usage, and behavior only in that language. User-facing CLI descriptions and runtime messages are also Chinese-only, which constitutes a locale/language constraint without opt-in or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The argparse description, help text, and all printed status/error messages are Chinese-only. This imposes a specific language on users without offering an alternative locale or an opt-in mechanism.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This file presents all substantive guidance in Chinese and does not indicate that users can choose another language or that the Chinese-only presentation is required for a specific region or compliance context.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This file is a markdown file, so natural-language policy checks apply. The phrase "凡自治之物" introduces non-English content in the core description without indicating that the skill is region-specific or that users can opt into that locale, which may conflict with language/locale policy expectations.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:3