save-money
3 findings (1 critical, 1 high, 1 medium), mainly prompt injection, resource abuse. Most recent scan 2026-02-07.
This skill exhibits CRITICAL security issues due to direct prompt injection attempts in both the YAML description field and markdown instructions. The skill attempts to override the agent's core decision-making behavior by embedding command-style directives that force the agent to classify and escalate tasks according to the skill's rules. The YAML description field contains extensive operational instructions that should never appear in metadata. The markdown body uses imperative language ('you MUST', 'Do NOT', 'NEVER', 'IMMEDIATELY') to hijack agent autonomy. Additionally, the unbounded escalation pattern ('when in doubt, escalate') creates availability risks through potential resource exhaustion. The skill's actual behavior (forcing behavioral modification) does not match its benign presentation as a cost-saving utility. While no data exfiltration or malicious code execution was detected, the prompt injection attempts represent a serious security threat that could compromise agent integrity and user trust. This skill should NOT be used in its current form.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco rates this CRITICAL and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Auto-detect task complexity for Claude models (Haiku + Sonnet). Route simple tasks to Haiku, escalate complex ones to Sonnet. Save 50%+ on API costs. | 適用 Claude 模型（Haiku + Sonnet），自動偵測任務難度，簡單用 Haiku，複雜升級 Sonnet，輕鬆省下 50% 以上的費用。— RULES: Before responding, classify the task. If it matches an escalation trigger, call sessions_spawn with the full task and model anthropic/claude-sonnet-4-20250514 IMMEDIATELY. Do NOT answer complex tasks yourself. ESCALATE: analysis, comparisons, planning, strategy, code >10 lines, reports, proposals, multi-step reasoning, tables, outlines, charts, long writing >3…
- Package
- 1 file, 8.1 KB
- SKILL.md
- 971 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Save Money · CRITICAL: Classify First, Then Act · Rule of Thumb · When to Escalate → MUST call sessions_spawn · Escalation triggers · By how people actually ask · By complexity signals · NEVER do this on Haiku · When to Stay on Haiku · Save even more: keep responses short · Save even more: de-escalate · Other providers
Findings
CRITICAL Direct Prompt Injection in YAML Description Field Prompt Injectionllm
The YAML description field contains embedded instructions that attempt to override the agent's core behavior. The description includes directives like 'RULES: Before responding, classify the task', 'Do NOT answer complex tasks yourself', 'ESCALATE:', 'NEVER on Haiku:', and 'STAY on Haiku:'. This is a direct prompt injection attack attempting to hijack the agent's decision-making process by embedding operational instructions in what should be a simple metadata description field.
SKILL.md
description: Auto-detect task complexity for Claude models (Haiku + Sonnet). Route simple tasks to Haiku, escalate complex ones to Sonnet. Save 50%+ on API costs. | 適用 Claude 模型（Haiku + Sonnet），自動偵測任務難度，簡單用 Haiku，複雜升級 Sonnet，輕鬆省下 50% 以上的費用。— RULES: Before responding, classify the task. If it matches an escalation trigger, call sessions_spawn with the full task and model anthropic/claude-sonnet-4-20250514 IMMEDIATELY. Do NOT answer complex tasks yourself. ESCALATE: analysis, comparisons, planning, strategy, code >10 lines, reports, proposals, multi-step reasoning, tables, outlines, charts, long writing >3 paragraphs, summarization, long translation. NEVER on Haiku: comparison tables, code >10 lines, multi-step analysis, reports, complex reasoning. STAY on Haiku: factual Q&A, definitions, greetings, reminders, short lookups, casual chat, 1-2 sentence tasks. When in doubt, escalate. Keep Haiku replies concise.HIGH Instruction Override Directives in Markdown Body Prompt Injectionllm
The markdown instructions contain multiple directive statements that attempt to override the agent's normal behavior patterns. Phrases like 'Before generating ANY response, you MUST:', 'Do NOT attempt to answer yourself', 'IMMEDIATELY call', 'NEVER do this on Haiku', and 'When in doubt, escalate' are command-style instructions attempting to hijack the agent's decision-making autonomy. The skill attempts to force the agent to always classify tasks according to its rules before responding.
SKILL.md
Before generating ANY response, you MUST:
1. Check: does this task match ANY escalation trigger below?
2. If YES → call `sessions_spawn()` IMMEDIATELY. Do NOT attempt to answer yourself.
3. If NO → respond directly on the current model.
When in doubt, escalate. A wrong escalation only costs a few cents. A bad answer on Haiku wastes the user's time.
## NEVER do this on Haiku
- NEVER write a comparison table yourself — escalatMEDIUM Unbounded Escalation Pattern Creates Availability Risk Resource Abusellm
The skill's escalation logic uses 'When in doubt, escalate' as a guiding principle, which could lead to excessive and unnecessary model switching. The broad escalation triggers (e.g., 'Prompt is longer than 200 characters', 'Multi-step reasoning', 'anything with first... then... finally') combined with the 'when in doubt' directive could cause the agent to constantly spawn new sessions, leading to resource exhaustion, increased latency, and degraded user experience. This creates an availability disruption risk through over-escalation.
SKILL.md
When in doubt, escalate. A wrong escalation only costs a few cents. A bad answer on Haiku wastes the user's time.
### By complexity signals
- Prompt is longer than 200 characters with specific requirements
- Contains multiple conditions or constraints
- Asks for structured output (tables, outlines, formatted documents)What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 8.1 KB |
External hosts referenced
github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/save-money
- Raw scan result: save-money-scan.json
- Badge for your README:
- Request a re-scan