deploy-prompt-management — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy-prompt-management (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
az account showaz deployment group create -g $RG -f infra/main.bicep -p infra/parameters.jsonResources:
// Cosmos DB document structure
{
"id": "system-prompt-rag-v3",
"name": "RAG System Prompt",
"version": 3,
"status": "active", // active | archived | testing
"template": "Answer based ONLY on the provided context.\n...",
"variables": ["context", "user_query", "max_tokens"],
"metadata": {
"author": "ai-team",
"created": "2026-04-01T00:00:00Z",
"tags": ["rag", "grounding", "production"],
"token_count": 450,
"model_compatibility": ["gpt-4o", "gpt-4o-mini"]
},
"ab_test": {
"enabled": false,
"variant_id": null,
"traffic_split": null
}
}# API endpoints
GET /api/prompts/{name}?version=latest # Get active prompt
GET /api/prompts/{name}/versions # List all versions
POST /api/prompts/{name} # Create new version
PUT /api/prompts/{name}/activate?version=3 # Activate specific version
POST /api/prompts/{name}/rollback # Rollback to previous
POST /api/prompts/{name}/ab-test # Start A/B test
GET /api/prompts/{name}/analytics # Usage analytics| Defense Layer | Implementation | Purpose |
|---|---|---|
| Input sanitization | Strip special tokens, escape delimiters | Prevent delimiter injection |
| Prompt armor | Wrap user input in clear boundaries | Isolate user content from instructions |
| Output validation | Check for prompt leakage | Prevent system prompt exposure |
| Rate limiting | Max 60 prompt retrievals/min | Prevent enumeration attacks |
| Audit logging | Log all prompt access | Track unauthorized usage |
// A/B test configuration
{
"test_name": "rag-prompt-grounding-v2-vs-v3",
"control": { "prompt_id": "system-prompt-rag-v2", "traffic": 50 },
"variant": { "prompt_id": "system-prompt-rag-v3", "traffic": 50 },
"metrics": ["groundedness", "relevance", "latency", "token_count"],
"duration_days": 7,
"min_samples": 1000,
"significance_level": 0.05
}| Issue | Cause | Fix |
|---|---|---|
| Prompt not found | Wrong version or name | Check name casing, verify active version |
| Template variables not replaced | Missing variable in request | Validate all variables provided at render time |
| A/B split uneven | Hash function bias | Use consistent hashing on user_id |
| Injection bypasses defense | Missing sanitization layer | Add input normalization before prompt assembly |
| High latency on prompt fetch | No caching | Add Redis cache (5-min TTL) for active prompts |
| Version conflict | Concurrent updates | Use optimistic concurrency with Cosmos DB etag |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.