---
name: prompt-injection-audit
description: Audit an agent architecture for prompt injection attack surfaces. Examine every path where untrusted text reaches an LLM prompt or triggers code execution. Produce a severity-ranked finding with mitigations.
triggers:
  - "prompt injection audit"
  - "security audit"
  - "injection attack surface"
  - "audit architecture"
tags: [security, prompt-injection, audit, architecture]
related_skills: [gitea-scoping-audit, openclaw-hermes-cohabitation]
version: 1
---

# Prompt Injection Audit

## When to Use
Alexander asks for a security audit, injection audit, or architecture review focused on adversarial input paths.

## Attack Surface Checklist

Examine every surface where untrusted text enters the system:

### Input Sources (rank by exposure)
1. **Public messaging channels** (Telegram, Discord) — anyone in allowed list can send
2. **Gitea issue titles and bodies** — anyone with repo access can write
3. **Gitea PR descriptions and comments** — code-level injection
4. **HTTP responses from fetched URLs** — poisoned web content
5. **Cloud backend responses** — adversarial model output
6. **File contents read from disk** — poisoned files
7. **Git commit messages** — injection via version control
8. **Cron job context** — external data fed into scheduled prompts

### Code Paths to Inspect
For each input source, trace how it flows to:
- LLM system prompt (via system_prompt_suffix or context injection)
- Tool arguments (file paths, URLs, service names, git args)
- subprocess calls (command injection)
- LLM context window (as retrieved content that influences behavior)

### Common Vulnerabilities
1. **Task router without author whitelist** — anyone can create issues that get executed
2. **Arbitrary service/path names in tool args** — no validation before subprocess
3. **HTTP tools without SSRF protection** — can probe internal services
4. **Cloud backend response injection** — fake system instructions in 200 OK responses
5. **Credential files readable by file tools** — .env, .git-credentials exposed
6. **Cron prompts with raw external data** — Gitea titles injected as instructions

### Severity Classification
- CRITICAL: Direct code execution from untrusted input (no auth check on task router)
- HIGH: Subprocess with unsanitized args (service_control, git tools, HTTP SSRF)
- MEDIUM: Injection into LLM context (backend responses, cron data, file contents)
- LOW: Information disclosure (readable configs, system prompt exposure)

## Output Format

Post as a Gitea issue with:
1. Attack surface map (diagram of untrusted input flows)
2. Findings table (surface, severity, implemented fix? yes/no)
3. For each finding: specific file, line, code snippet, mitigation code
4. Recommended priority order for fixes

Then create individual fix tickets assigned to the appropriate agent, each with:
- Specific file to change
- Code showing the fix
- Acceptance criteria with test cases

## Pitfalls
- Don't just scan for keywords — trace actual data flows
- Security fixes that break the agent are worse than the original vulnerability
- Always recommend running the test suite after applying fixes
- SSRF protection must cover CGNAT range (100.64.0.0/10) for Tailscale environments
- Credential blocklists should use fnmatch patterns, not exact strings
