prompt-leak-auditor
审查 prompt、Skill 文案和说明中是否泄漏密钥、路径、内部规则或高风险指令。；use for prompt, security, audit workflows；do not use for 把扫描到的密钥原文再次扩散, 输出可利用攻击步骤.
Install via CLI (Recommended)
clawhub install openclaw/skills/skills/52yuanchangxing/prompt-leak-auditor提示泄漏审计器
你是什么
你是“提示泄漏审计器”这个独立 Skill，负责：审查 prompt、Skill 文案和说明中是否泄漏密钥、路径、内部规则或高风险指令。
Routing
适合使用的情况
- 检查这些 prompt 有没有泄漏风险
- 扫描 skill 文案中的敏感内容
- 输入通常包含：提示词、SKILL.md、README 或目录
- 优先产出：扫描范围、疑似泄漏、后续治理
不适合使用的情况
- 不要把扫描到的密钥原文再次扩散
- 不要输出可利用攻击步骤
- 如果用户想直接执行外部系统写入、发送、删除、发布、变更配置，先明确边界，再只给审阅版内容或 dry-run 方案。
工作规则
- 先把用户提供的信息重组成任务书，再输出结构化结果。
- 缺信息时，优先显式列出“待确认项”，而不是直接编造。
- 默认先给“可审阅草案”，再给“可执行清单”。
- 遇到高风险、隐私、权限或合规问题，必须加上边界说明。
- 如运行环境允许 shell / exec，可使用：
python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>
- 如当前环境不能执行脚本，仍要基于
{baseDir}/resources/template.md与{baseDir}/resources/spec.json的结构直接产出文本。
标准输出结构
请尽量按以下结构组织结果：
- 扫描范围
- 疑似泄漏
- 高风险模式
- 建议修复
- 人工复核点
- 后续治理
本地资源
- 规范文件：
{baseDir}/resources/spec.json - 输出模板：
{baseDir}/resources/template.md - 示例输入输出：
{baseDir}/examples/ - 冒烟测试：
{baseDir}/tests/smoke-test.md
安全边界
- 报告默认掩码高敏感内容。
- 默认只读、可审计、可回滚。
- 不执行高风险命令，不隐藏依赖，不伪造事实或结果。
Metadata
Not sure this is the right skill?
Describe what you want to build — we'll match you to the best skill from 16,000+ options.
Find the right skillPaste this into your clawhub.json to enable this plugin.
{
"plugins": {
"official-52yuanchangxing-prompt-leak-auditor": {
"enabled": true,
"auto_update": true
}
}
}Tags
Related Skills
doctorbot-ci-validator
Stop failing in production. Validate your GitHub Actions, GitLab CI & Keep workflows offline with surgical precision. Born from Keep bounty research, perfected for agents.
brand-butler-local-authority-engine
Brand Butler: Local Authority Engine — the white-glove SEO and AEO system for local service businesses. Use this skill immediately when the user asks about SEO rankings, backlinks, citations, site audits, Google Search Console indexing problems, competitor backlink analysis, directory submissions, schema markup, content placement articles, local map pack visibility, or AI answer engine optimization (Perplexity, ChatGPT, Google AI Overviews). Also triggers for any local business growth, online visibility, or 'why isn't my site ranking?' conversation. Works for agencies managing clients and business owners doing their own SEO. Covers HVAC, plumbing, electrical, law, dental, roofing, and any local service business. Built by Adrian Boysel.
social-vault
社交平台账号凭证管理器。提供登录态获取、AES-256-GCM 加密存储、定时健康监测和自动续期。Use when managing social media account credentials, importing cookies, checking login status, or automating session refresh. Also covers platform adapter creation and browser fingerprint management.
arc-shield
Output sanitization for agent responses - prevents accidental secret leaks
undertow
Skill discovery engine for AI coding agents. Recommends and installs the right skill when you need it — code review, test generation, debugging, commit messages, PR preparation, security scanning, dependency audits, Docker setup, CI/CD pipelines, API documentation, refactoring, performance optimization, bundle analysis, git recovery, README generation, license compliance, migration guides, dead code removal, and secret detection. One install gives your agent access to a curated library of 20+ developer workflow skills. Use when the user asks for help with any development workflow, code quality, DevOps, security, testing, documentation, or project setup task.