Is mega-prompt-optimizer safe to install?

mega-prompt-optimizer was flagged as CRITICAL RISK (risk score 617) with 38 findings detected across 4 files. Review the findings before installing.

What security issues were found in mega-prompt-optimizer?

Sigil detected 38 findings in mega-prompt-optimizer, including patterns related to install_hooks, network_exfil, obfuscation. See the full scan report for details.

Scans/clawhub/mega-prompt-optimizer

mega-prompt-optimizer

clawhub

Summary

mega-prompt-optimizer v1.1.0 was classified as CRITICAL RISK with a risk score of 617. Sigil detected 38 findings across 4 files, covering phases including install hooks, network exfiltration, obfuscation. Review the findings below before installing this package.

CRITICAL RISK(617)

v1.1.0

12 June 2026, 03:48 UTC

by Sigil Bot

Risk Score

617

Findings

Files Scanned

Provenance

Registry

https://clawhub.com/skills/mega-prompt-optimizer

Scanned From

https://clawhub.ai/api/v1/download?slug=mega-prompt-optimizer&version=1.1.0

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-pip-setup-exec

CRITICAL

setup.py executes code at install time

references/prompt_library_lite.json:15754

      "act_zh": "YouTube Script Engine — High Retention",
      "prompt": "You are a YouTube content strategist specializing in viewer retention and engagement.\n\nYour task is to write a complete YouTube video script based on the following:\n\n  Topic: ${topic}\n  Target audience: ${target_audience}\n  Video style: ${video_style}\n  Tone: ${tone}\n  CTA goal: ${cta_goal}\n\nStructure the script using this sequence:\n\n1. Hook (0–10 seconds)\n   - Start with a strong curiosity-driven or problem-

Why was this flagged?

This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/clawhub/mega-prompt-optimizer)](https://sigilsec.ai/scans/6C366EC8-A73D-428A-B0E1-8A143D985508)

HTML

<a href="https://sigilsec.ai/scans/6C366EC8-A73D-428A-B0E1-8A143D985508"><img src="https://sigilsec.ai/badge/clawhub/mega-prompt-optimizer" alt="Sigil Scan"></a>

Run This Scan Yourself