Prompt Injection Auditor Pro

The free version checks one file for 4 risk categories. Pro scans entire directories against 12 threat categories with numeric risk scoring, SARIF output, and GitHub Actions integration.

prompt-injection-auditor has 7 installs — developers clearly need SKILL.md security scanning. But the free version only scans single files against 4 basic patterns. Teams with 50+ skills need batch scanning, OWASP compliance evidence for security reviews, and CI/CD gates to block insecure deployments. None of that is possible with the free version.

• 12-category threat engine — adds supply chain, prompt leaking, privilege escalation, context abuse, multi-agent confusion, tool chain poisoning, and compliance violations to the free version's 4 categories

• OWASP LLM Top 10 mapping — every finding maps to a specific OWASP identifier with compliance percentage reports for security reviews

• Batch directory scanning — scan 100+ SKILL.md files in parallel with per-file results and aggregate summary

• Numeric CVSS-like risk scoring — 0-10 scores with vector strings instead of vague HIGH/MEDIUM/LOW text

• SARIF output for GitHub Code Scanning — upload results directly to GitHub's Security tab for PR annotations

• Custom rule engine via YAML — define organization-specific security policies (e.g., "no external API calls", "writes only to /tmp") and merge with built-in rules

• Auto-generated remediation patches — concrete code snippets for each finding, not generic advice

• SQLite scan history — track security posture over time across multiple scans

• CI/CD exit codes — --fail-on critical blocks deployment in GitHub Actions, GitLab CI, or any pipeline

• Multi-framework support — tuned detection for Claude Code, Cursor, Codex, Copilot, Aider, and Windsurf skill formats

• GitHub Actions annotation format — findings appear inline on PR diffs, not just in logs

The free version gives you a text report with HIGH/MEDIUM/LOW labels for 4 categ