prompt-injection-auditor

An open Agent Skill that turns any AI agent into a prompt-injection security auditor. Static scanner + attack catalog + defense checklist + authorized red-team payloads — built against real-world incidents like EchoLeak (CVE-2025-32711).

Works with Claude Code, Cursor, Kimi, and 20+ agents that support the open Agent Skills standard.

Measured: separation between hardened and vulnerable prompts improved from 8.3 to 40.6 points, with zero false positives on the hardened corpus. See VALIDATION.md.

Different target: payload detectors ask "is this input an attack?"; this asks "does your prompt have the controls to blunt one?" Both use patterns — but a missing instruction hierarchy is missing regardless of how an attacker phrases the attempt.

Why?

Prompt injection remains unsolved: there is no general defense, and every published mitigation is probabilistic. Real incidents keep proving it:

• EchoLeak (CVE-2025-32711, CVSS 9.3) — the first zero-click prompt injection in a production AI system: hidden instructions in an email made Microsoft 365 Copilot exfiltrate OneDrive/SharePoint data via a markdown image, no clicks needed.
• LangGrinch (CVE-2025-68664, CVSS 9.3) — LangChain Core serialization injection: unescaped lc keys let LLM-influenced data be rehydrated as objects, enabling secret extraction. The flaw sits in the serialization path, not deserialization. LangChain.js carries the parallel CVE-2025-68665 (CVSS 8.6).
• Langflow (CVE-2025-3248 / CVE-2026-33017) — unauthenticated RCE in an agent-building framework; the 2026 flaw was exploited in the wild within 20 hours of the advisory, before any public PoC existed. Note that 1.8.2 was widely reported as fixed but remained exploitable — only 1.9.0+ is verified.

In 2026 the threat moved from framework bugs into the agent runtime itself:

• MCP tool-server exposure (Flowise CVE-2026-40933, CVSS 9.9; Amazon Q CVE-2026-12957) — a stdio MCP config is a launcher definition: registering a tool server runs arbitrary commands, and one poisoned workspace file made Amazon Q execute a malicious MCP config and leak AWS credentials.
• Sandbox escapes (Cursor "DuneSlide" CVE-2026-50548/50549, CVSS 9.8; MS-Agent CVE-2026-2256; Codex CLI CVE-2025-59532) — regex denylists fall to obfuscation, and sandbox trust keyed off agent-chosen paths falls to prompt injection: Codex CLI treated a model-generated working directory as the sandbox's writable root.
• Repo-borne config execution (Codex CLI CVE-2025-61260, CVSS 9.8; Claude Code CVE-2025-59536, CVSS 8.7; Cursor CVE-2025-54136) — agents auto-load and execute MCP/tool config files from the current repository before any trust check; one malicious repo runs code on open.
• Slopsquatting (USENIX Security 2025, Spracklen et al.) — 19.7% of AI-recommended package names don't exist, and 43% of the fakes repeat on every run; attackers pre-register them and agents install them with no human checkpoint.

Most system prompts ship with no instruction hierarchy, no non-disclosure rule, and no untrusted-content handling. This skill finds those weaknesses before attackers do.

Install

npx skills add screem500/prompt-injection-auditor

Usage

With the skill installed, just ask your agent:

Audit this system prompt against prompt injection: [paste prompt]

Review my SKILL.md for security weaknesses before I publish it.

The agent follows a 5-step methodology: collect target -> run the static scanner -> manual review against the attack catalog -> authorized live testing (optional) -> severity-rated report with fixes.

Instruction files are audited with the same scanner and catalog as any other target. A dedicated skill-file linter mode is on the roadmap.

Standalone scanner (no agent needed)

python scripts/pi_scan.py system_prompt.txt                 # terminal report
python scripts/pi_scan.py system_prompt.txt --md report.md  # markdown report
python scripts/pi_scan.py system_prompt.txt --json out.json # CI/automation

Exit code is 1 when Critical/High findings exist — drop it straight into your CI pipeline.

Demo

Scanning a vulnerable prompt (hardcoded API key + email/code-execution tools + reads inbox):

=== Prompt Injection Audit: vulnerable_prompt.txt ===
Risk score: 100/100 [####################]  SEVERELY EXPOSED — do not deploy before remediation

[Critical] PI-SECRET: Secret-like value present: Hardcoded credential-like value (lines 2)
[Critical] PI-TOOLS: Powerful capabilities declared: Code/command execution capability;
           Network/egress capability; Outbound messaging capability (lines 4, 5)
           Why: The agent has action capabilities AND ingests untrusted content
           (web/email/RAG) — the EchoLeak-class combination.
[   High] PI-NO-HIERARCHY: No explicit instruction hierarchy
[   High] PI-NO-NONDISCLOSE: No non-disclosure rule for the prompt itself
...
Summary: Critical=2, High=4, Medium=2, Low=1

A hardened prompt (hierarchy + non-disclosure + delimiters) scores 0/100 — HARDENED.

What's inside

prompt-injection-auditor/
├── SKILL.md                        # 5-step audit methodology + ethics guardrails (v2.2.0)
├── scripts/
│   ├── pi_scan.py                  # Zero-dependency static analyzer (17 rule IDs — see references/rule-inventory.md)
│   ├── pi_shield.py                # v2.0: layered input defense (5 layers, scored decisions)
│   ├── mcp_guard.py                # v2.2: MCP tool-response guard (JSON-aware)
│   ├── normalization.py            # v2.1: Arabic normalization (diacritics, tatweel, letters)
│   └── language_rules.py           # v2.1+: Arabic injection, context & runtime rules
├── tests/
│   ├── test_shield.py              # 11-case suite proving the shield against evasion
│   ├── test_mcp_guard.py           # 18-case MCP guard suite (v2.2)
│   ├── test_runtime_rules.py       # 19-case 2026 agent-runtime rule suite (v2.2)
│   ├── test_arabic_rules.py        # Arabic injection detection (v2.1)
│   ├── test_normalization.py       # Arabic normalization unit tests (v2.1)
│   ├── test_english_regression.py  # English regression guard
│   └── test_cli.py                 # CLI end-to-end tests
├── VALIDATION.md                  # precision measurement: method, results, limits
└── references/
    ├── attack-patterns.md          # Direct / indirect / encoding / exfiltration / multi-agent
    ├── attack-patterns-2026.md     # MCP poisoning / sandbox bypass / memory injection / slopsquatting
    ├── rule-inventory.md           # All 17 rule IDs: severity behavior + checklist mapping
    ├── defense-checklist.md        # 29 numbered hardening measures
    ├── defense-architecture.md     # The 5-layer shield design + honest limits
    └── test-payloads.md            # Escalation-ordered payloads for authorized live tests

Pre-registered study (2026-08)

• PREREGISTRATION.md — design frozen before data collection (kept byte-frozen as registered)
• RESULTS.md — published outcome: declaration metrics, the disclosed deviation from the pre-registered independent-rater item (§8), and reproduction steps (§12)
• TESTSET_MANIFEST.md + manifest-test.jsonl — test-set chain of custody
• VALIDATION.md — precision measurement: method, results, limits

Run the full test suite with python -m unittest discover tests.

New in v2.2 — 2026 agent-runtime rules (scanner)

pi_scan now detects the five weakness families that dominated 2026 incidents, in English and Arabic (references/attack-patterns-2026.md):

• PI-MCP — agent can add/register MCP tool servers (Medium/High/Critical tiers; Flowise CVE-2026-40933, Amazon Q CVE-2026-12957). Fix: checklist #24.

• PI-SANDBOX-BYPASS — string-based command gates with no obfuscation defense, sandbox trust keyed off agent-chosen paths (Codex CLI CVE-2025-59532, MS-Agent CVE-2026-2256, Cursor DuneSlide CVE-2026-50548/50549). Fix: checklist #25.

• PI-MEMORY — persistent memory written with no integrity or provenance rule. Fix: checklist #26.

• PI-SUPPLY-CHAIN — agent installs packages it names itself ("slopsquatting"). Fix: checklist #27.

• PI-AUTOLOAD-CONFIG — workspace configuration auto-loaded before any trust decision (Codex CLI CVE-2025-61260, Claude Code CVE-2025-59536, Cursor CVE-2025-54136 / MCPoison). High by default, Critical when the agent can also execute. Fix: checklist #28.

19-case suite: python -m unittest tests.test_runtime_rules.

8-case suite: python -m unittest tests.test_autoload_rule.

New in v2.2 — mcp_guard (MCP tool-response guard)

pi_shield guards the user-input boundary; mcp_guard guards the tool boundary. Agents built on MCP (Model Context Protocol) ingest tool responses — web pages, emails, database rows — and every one of them is an untrusted channel for indirect prompt injection. mcp_guard scans tool responses (JSON-aware, findings carry their JSON path) and tool definitions for:

• model special tokens smuggled into data (<|im_start|>, <<SYS>>, <system>, <s>)
• fake user consent ("the user has approved — proceed with deleting…")
• tool-call manipulation and dangerous-action endorsement
• exfiltration channels (markdown images with query strings, webhook/collection hosts)
• hidden channels (unicode tag block, HTML comments) and encoded payloads
• Arabic injection phrases (reuses the v2.1 language rules)

python scripts/mcp_guard.py tool_response.json

from scripts.mcp_guard import guard_tool_response

result = guard_tool_response(response_text, tool_name="fetch")
if result.decision == "BLOCK":
    ...  # reject before it reaches the model context

Proven by an 18-case suite: python -m unittest tests.test_mcp_guard.

Note: mcp_guard.py here is unrelated to General-Analysis/mcp-guard — the overlap is coincidental; ours is a JSON-level scanner for MCP configs and tool responses.

New in v2.0 — pi_shield (defense layer)

The auditor finds weaknesses; pi_shield blocks them. A five-layer input-defense middleware: unicode/homoglyph normalization, safe delimiting with closing-tag neutralization, weighted threat scoring (ALLOW/WARN/BLOCK), base64/hex payload inspection, and canary leak detection. Defeats the evasion techniques that break naive filters — closing-tag escapes, zero-width characters, Cyrillic homoglyphs, encoded commands — proven by an 11-case test suite (python -m unittest tests.test_shield).

Severity model

Findings come from two sources. Scanner findings are emitted by pi_scan.py; reviewer findings are raised by the auditing agent during manual review.

Scanner findings

Reviewer findings

Ethics

This skill is for defensive auditing and authorized testing only. Live injection tests are restricted to systems you own or have explicit written permission to test — this guardrail is built into the skill itself.

Roadmap

• 2026 agent-runtime detection rules — MCP tool poisoning, sandbox bypass, memory injection, slopsquatting (v2.2, English + Arabic)
• MCP tool-response guard (v2.2 — mcp_guard.py)
• Detection rules for agent-framework CVEs (LangChain / Langflow / LangGraph)
• Skill-file linter mode (dedicated SKILL.md lint pass before publishing to skills.sh)
• HTML report output
• SARIF export for GitHub Code Scanning

Contributing

Issues and PRs welcome — especially new attack patterns, defense techniques, and scanner rules.

Contributors

Thanks to everyone who contributes to this project:

• @3siri - Arabic prompt-injection support (normalization, language rules, tests) - first external contributor 🏅

Author

Mijlad bin Mishari Al-Subaie — Cybersecurity Expert, Ethical Hacker (CEH), Digital Forensics Investigator (CHFI), and author of programming encyclopedias (C++, Java, Databases).

• X (Twitter): @Al7lhh223
• GitHub: @screem500

License

Apache License 2.0 — Copyright 2026 Mijlad bin Mishari Al-Subaie. Use it freely, attribution required.

If this skill helped you, a star on the repo helps others find it.