Audit Report: prompt-optimization — 🟠 D (50/100)

Audited by TAR Engine · 2026-06-14 · Report format v0.2

Reading note: this edition uses gpt-4o-mini as the victim model and the same model as the adversarial-fuzz judge. Findings reflect missing defenses in the SKILL.md itself — not a verdict on any specific victim model. The remediation belongs in SKILL.md, not in the model.

Source: https://github.com/majiayu000/claude-skill-registry/blob/main/skills/ai-llm/prompt-optimization-proflead-codex-skills-library-f7a86410/SKILL.md

Verdict: High risk — 4 high-severity issues need author attention before deploying to a shared environment.

What this skill does

Auditor's read (LLM-generated): The prompt-optimization skill analyzes user prompts to identify and eliminate ambiguity, ensuring clarity and improved output quality from LLMs. It rewrites prompts while preserving the original intent and may include additional constraints to enhance the prompt's effectiveness. The output consists of the revised prompt and a brief explanation of the improvements made.

Author description: Improve and rewrite user prompts to reduce ambiguity and improve LLM output quality. Use when a user asks to optimize, refine, clarify, or rewrite a prompt for better results, or when the request is about prompt optimization or prompt rewriting.

Observed: prompt-optimization is 5 top-level sections (Goal, Workflow, Output format, Constraints, Example triggers); ~28 lines of instructions, concise body.

Frontmatter facts:

• Body size: 28 lines / 757 chars

Score breakdown by category

Each category gets its own sub-score. A category with no rule hits gets 100; a category with a single critical finding drops to 80.

Historical baseline (same-skill comparison)

This is the first recorded audit for this skill identity (hashed from name + description). The baseline section will show mean / stddev / trend after 2+ audits accumulate.

Findings

6 rules matched. Each finding below cites the matched line and a remediation hint.

1. 🟠 SEM-008 — external_payload_blind_trust (HIGH)

• Category: Malicious payload signatures
• Why this matched: This example trigger could represent an external command or variable that the skill does not validate, potentially leading to unintended actions based on untrusted input.
• Rule intent: Trusts external content (downloaded file, remote prompt template, third-party output) without validation
• Matches in document: 1

Evidence (1 of 1 match):

Line 34:

- $automating-productivity

Suggested fix: Ensure that any external inputs or commands are validated and sanitized before being processed to prevent misuse or unintended consequences.

2. 🟠 SEM-002 — ambiguous_instruction (HIGH)

• Category: Prompt injection / scope override
• Why this matched: This instruction could lead to the model misinterpreting user prompts that contain implicit knowledge or context, potentially resulting in outputs that do not align with user expectations.
• Rule intent: Ambiguous instruction that could be exploited as a prompt injection primitive
• Matches in document: 1

Evidence (1 of 1 match):

Line 28:

- Do not assume domain knowledge not in the original prompt.

Suggested fix: Clarify this instruction by specifying how to handle cases where domain knowledge is implied but not explicitly stated, perhaps by prompting the user for clarification when necessary.

3. 🟠 SEM-003 — capability_overreach (HIGH)

• Category: Prompt injection / scope override
• Why this matched: The skill's description suggests it may attempt to rewrite prompts in a way that could inadvertently change the user's original intent or context, which is beyond its stated purpose.
• Rule intent: Capability claim over-broad relative to the skill's stated purpose
• Matches in document: 1

Evidence (1 of 1 match):

Line 3:

Improve and rewrite user prompts to reduce ambiguity and improve LLM output quality.

Suggested fix: Limit the skill's capabilities to only optimizing prompts without altering the fundamental meaning or context, and clarify this limitation in the description.

4. 🟠 SEM-007 — irreversible_action_no_confirmation (HIGH)

• Category: Shell safety
• Why this matched: If the skill is used to optimize prompts that could lead to irreversible actions (like sending emails or publishing content), it should require user confirmation before proceeding.
• Rule intent: Skill instructs the LLM to take an irreversible action without explicit user confirmation
• Matches in document: 1

Evidence (1 of 1 match):

Line 10:

Improve the user's prompt so Codex (or any LLM) produces better output while preserving intent.

Suggested fix: Add a confirmation step before executing any prompt that could result in irreversible actions, ensuring the user explicitly agrees to the changes suggested.

5. 🟡 SEM-001 — semantic_evasion (WARNING)

• Category: Prompt injection / scope override
• Why this matched: The phrasing 'preserving intent' could be interpreted to mean that the model may still alter the user's request in ways that are not transparent, potentially leading to unintended outputs.
• Rule intent: Polite phrasing that achieves the same effect as a critical-flagged pattern
• Matches in document: 1

Evidence (1 of 1 match):

Line 10:

Improve the user's prompt so Codex (or any LLM) produces better output while preserving intent.

Suggested fix: Rephrase this to explicitly state that the model will not alter the user's request beyond what is necessary for clarity and optimization, ensuring transparency in the process.

6. 🟡 SEM-004 — prompt_injection_subtle (WARNING)

• Category: Prompt injection / scope override
• Why this matched: This instruction could be exploited by a user providing a prompt that includes malicious intent or instructions that could lead to harmful outputs, as the model may not adequately filter such inputs.
• Rule intent: Subtle nudge to hide, mislead, or impersonate that regex couldn't catch
• Matches in document: 1

Evidence (1 of 1 match):

Line 16:

Rewrite the prompt to remove ambiguity and provide clear instructions.

Suggested fix: Implement checks to identify and reject prompts that contain harmful or malicious instructions, ensuring the model prioritizes user safety.

Scope of this edition

The audit covers static rule matching, semantic-layer LLM analysis, and adversarial prompt fuzzing. Three classes of risk live beyond this edition's scope. We name them explicitly:

• Runtime behavior. Verifying what a skill actually does at runtime requires sandboxed execution. That layer ships in a future edition; today's report reflects what the skill states it will do, plus the LLM's read of how it would behave.
• Cross-skill composition. When this skill is chained with others through a planner, the emergent state flow between skills is its own analysis surface. Out of scope for single-skill reports.
• External payloads. A skill that fetches and runs a remote script is flagged at the fetch step. The remote payload itself is audited as a follow-up once the sandbox layer is online.

Methodology

How the score was computed:

1. Document text is scanned against a static rule set of 30 signature patterns. Each rule carries a permanent rule_id (e.g. PI-001), a category, a severity, and a remediation template.
2. Each rule hit deducts from a 100-point base: critical -20, high -10, warning -5, info -1.
3. The letter grade is gated by max severity AND total score: any critical → F; any high → at most D; any warning → at most C; otherwise A/B by score band.
4. Per-category sub-scores apply the same deduction formula to that category's findings only — so you can see WHICH risk surface drove the loss.

Rule matches are augmented by an LLM-based semantic pass when an LLM endpoint is configured. The semantic pass uses rule IDs SEM-001 … SEM-008.

When an LLM endpoint is configured the skill is also probed with a 15-attack adversarial corpus (5 classes × 3 prompts), each judged by a separate LLM call. Failed classes surface as rule IDs AR-001 … AR-005.

Engine + rule set provenance:

• Engine version: 0.2.0
• Rule set version: 1.0.0
• Commit: unknown
• Domain config: general
• Audited at: 2026-06-14T20:47:22.467033Z
• Rules applied: 34 static rules (full registry below)

Known limitations of this report

• False positives are possible. A SKILL.md documenting a dangerous pattern (e.g. an audit skill explaining curl | sh) will match the rule even though the skill's intent is to detect, not execute. Read the matched lines before reacting.
• False negatives are guaranteed in narrow ways. Patterns obfuscated by string concatenation, environment variable indirection, or non-English equivalents will slip past regex.
• Baseline sample size. Same-skill trend analysis (§ Historical baseline) gets meaningful with n≥3 prior audits. With fewer priors the stddev band is widened to avoid false out-of-band signals.

About TAR Engine

TAR Engine is an OSS "wish machine" with built-in audit. Speak a goal; the engine plans, runs and audits skills inside its own container. BYOK. — github.com/qingxuantang/tar-engine