Promptingco

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:38 AM UTC
• Version: 1.0.0

Overview

The skill matches its stated Prompting Company purpose, but it relies on a sensitive browser session cookie, passes that cookie into subagent prompts, and can publish live content.

Review before installing. Only use this skill if you are comfortable giving an agent a live Prompting Company browser session cookie that can read workspace data and perform write actions such as creating prompts, approving items, and publishing drafts. Prefer a scoped API token if available, avoid pasting the cookie into chat or logs, and confirm the correct API host before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:219
• Finding: Browser Session Credential Exposed to General-Purpose Subagents<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:219-250` **Additional Locations**: `SKILL.md:259-280`, `SKILL.md:289-310`, `SKILL.md:885-927`, `SKILL.md:939-975`, `SKILL.md:987-1029` **Vulnerability Type**: Plaintext credential propagation across agent boundaries **Risk Level**: Medium ### Vulnerable Code ```typescript Task({ subagent_type: "general-purpose", description: "Track new prompt workflow", prompt: ` Help the user track a new prompt on The Prompting Company platform. Context: - Brand ID: ${brandId} - Session token: ${TPC_SESSION_TOKEN} - Base URL: https://app.promptingco.com Steps: 1. Ask user for the prompt text they want to track 2. Check for duplicates: GET /api/v1/prompts/check-duplicates?brandId=${brandId}&message=<prompt_text> 3. If duplicate exists, ask user if they want to continue 4. Fetch user personas: GET /api/v1/personas?brandId=${brandId} 5. Use the first persona as default (or let user select if multiple) 6. Create prompt with 4 conversation queries (one per engine): POST /api/v1/conversation-queries/bulk Body: { "brandId": "${brandId}", "queries": [ { "prompt": "<user_text>", "model": "chatgpt", "maxTurns": 1, "userPersonaId": "<PERSONA_ID>", "userPersona": "<PERSONA_NAME>" }, { "prompt": "<user_text>", "model": "gemini", "maxTurns": 1, "userPersonaId": "<PERSONA_ID>", "userPersona": "<PERSONA_NAME>" }, { "prompt": "<user_text>", "model": "deepseek", "maxTurns": 1, "userPersonaId": "<PERSONA_ID>", "userPersona": "<PERSONA_NAME>" }, { "prompt": "<user_text>", "model": "sonar", "maxTurns": 1, "userPersonaId": "<PERSONA_ID>", "userPersona": "<PERSONA_NAME>" } ] } 7. Confirm creation: "Created prompt tracked across ChatGPT, Gemini, DeepSeek, and Perplexity" Use the session token in all requests: -H "Cookie: __Secure-better-auth.session_token=${TPC_SESSION_TOKEN} ...[truncated 2126 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never interpolate session cookies, API keys, or other credentials into Task prompts. 2. Route all authenticated requests through a dedicated API wrapper owned by the parent agent. 3. Have the wrapper inject the Cookie header only at request time through a secret-aware request facility. 4. Delegate only non-sensitive data, such as the selected brand ID, desired operation, and already-sanitized API results. 5. Replace browser session cookies with narrowly scoped API tokens where the platform supports them. 6. Scope separate tokens to read-only analytics, prompt management, and publishing operations. 7. Prevent credentials from appearing in prompts, logs, traces, errors, command output, and process arguments. 8. Redact Cookie and authorization headers in observability systems. 9. Rotate any token that may already have been exposed through historical Task traces. 10. Require explicit user confirmation immediately before publishing or other externally visible operations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20
• Finding: Conflicting API Origins Can Cause Authenticated Requests to Reach an Unintended Host<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-34` **Additional Location**: `references/api-guide.md:5-9` **Vulnerability Type**: Inconsistent authenticated endpoint configuration **Risk Level**: Medium ### Vulnerable Code `SKILL.md` specifies: ```markdown ## Authentication All API calls use session cookie authentication via Better Auth. **Required environment variables:** - `TPC_SESSION_TOKEN` — the `__Secure-better-auth.session_token` cookie value (user provides this) **Configuration (hardcoded):** - `TPC_BASE_URL` — always use `https://app.promptingco.com` (production) - `TPC_BRAND_ID` — fetched dynamically via `/api/v1/brands` endpoint (see First-Time Setup) - `TPC_ORG_SLUG` — optional, derived from brand selection if needed **Note:** In all curl examples below, `$TPC_BRAND_ID` represents the brand ID selected by the user during first-time setup. Replace it with the actual brand ID value when making requests. **Every `curl` request must include:** ``` -H "Cookie: __Secure-better-auth.session_token=$TPC_SESSION_TOKEN" ``` ``` However, `references/api-guide.md` specifies a different host: ```markdown ## Base Configuration | Variable | Description | Example | |---|---|---| | `TPC_BASE_URL` | Platform base URL | `https://app.promptingcompany.com` | | `TPC_SESSION_TOKEN` | `__Secure-better-auth.session_token` cookie value | `eyJ...` | | `TPC_BRAND_ID` | Default brand UUID | `abc-123-def-456` | | `TPC_ORG_SLUG` | Organization slug | `my-company` | ``` ### Technical Analysis The project identifies two distinct domains as the Prompting Company API origin: - `https://app.promptingco.com` - `https://app.promptingcompany.com` At the same time, it instructs the agent to attach a privileged browser session cookie to authenticated requests. No origin verification, hostname allowlist, redirect policy, or authoritative configuration mechanism is supplied to resolve the discrepancy. The audit evidence does not establish which domain is ...[truncated 1707 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Verify the authoritative production API origin through trusted platform documentation and ownership records. 2. Replace every inconsistent reference with one canonical HTTPS origin. 3. Define the origin once in a centrally controlled constant rather than duplicating it in documentation. 4. Before adding authentication, parse the URL and require an exact hostname match against a strict allowlist. 5. Reject user-supplied origins, subdomains, alternate suffixes, embedded credentials, and non-HTTPS schemes. 6. Disable automatic cross-origin redirects for authenticated requests, or strip authentication before following any redirect. 7. Verify TLS certificates normally and never permit insecure TLS options. 8. Add automated tests that scan every documented endpoint and fail when an unexpected origin appears. 9. Document the expected cookie domain and the procedure for validating endpoint ownership. 10. Rotate session credentials if authenticated requests may previously have been sent to the wrong host. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:583
• Finding: User-Controlled Prompt Text Is Embedded Directly in a URL Query String<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:583-587` **Additional Locations**: `SKILL.md:232`, `SKILL.md:905` **Vulnerability Type**: Improper URL encoding and sensitive data exposure through query strings **Risk Level**: Low ### Vulnerable Code ```markdown ### Check for duplicate prompts ```bash curl -s "https://app.promptingco.com/api/v1/prompts/check-duplicates?brandId=$TPC_BRAND_ID&message=YOUR_PROMPT_TEXT" \ -H "Cookie: __Secure-better-auth.session_token=$TPC_SESSION_TOKEN" ``` ``` The delegated workflow repeats the unsafe construction: ```text Check duplicates: GET /api/v1/prompts/check-duplicates?brandId=${brandId}&message=<prompt_text> ``` ### Technical Analysis The Skill directs the agent to concatenate user-supplied prompt text into the `message` query parameter without requiring percent-encoding. Prompt text may contain `&`, `=`, `#`, `%`, spaces, line breaks, or other reserved characters. These characters can alter how clients, intermediaries, and the server parse the URL. For example, a prompt containing `&brandId=OTHER_VALUE` may introduce an additional parameter. The server's handling of duplicate parameters determines whether the injected value is ignored, appended, or used instead of the intended value. Query strings are also commonly retained by HTTP access logs, reverse proxies, monitoring systems, shell history, process listings, and task traces. Consequently, confidential prompt content may be disclosed even when TLS protects the request in transit. ### Attack Path 1. A user or attacker provides prompt text containing sensitive information or reserved URL characters. 2. The agent substitutes that text directly into the documented URL. 3. The HTTP client parses reserved characters as query delimiters rather than as part of the prompt. 4. The server receives malformed, truncated, or attacker-influenced query parameters. 5. Infrastructure components record the complete URL, exposing the prompt content to log ...[truncated 668 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct query strings through raw string interpolation. 2. Use a URL-building library that percent-encodes each parameter independently. 3. For `curl`, use explicit encoding: ```bash curl -sS --get "https://app.promptingco.com/api/v1/prompts/check-duplicates" \ --data-urlencode "brandId=$TPC_BRAND_ID" \ --data-urlencode "message=$PROMPT_TEXT" \ -H "Cookie: __Secure-better-auth.session_token=$TPC_SESSION_TOKEN" ``` 4. Prefer a POST endpoint with a JSON request body if prompt text may be long or confidential. 5. Configure proxies and application logs to omit or redact query strings. 6. Avoid placing confidential values in command-line arguments where they may appear in process listings. 7. Validate prompt length and reject control characters before constructing the request. 8. Define deterministic server behavior for duplicate parameters and reject ambiguous requests. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill asks the user to supply a live browser session cookie value, but it does not provide a meaningful safety warning about the sensitivity of that credential or the risks of sharing it with an agent workflow. Session cookies are equivalent to authenticated access, so collecting them without explicit caution raises the risk of credential mishandling, replay, or over-collection.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- GET https://app.promptingco.com/api/v1/prompt-topics?brandId=${brandId}
    - For each topic: GET https://app.promptingco.com/api/v1/prompt-topics/{topicId}/prompts?brandId=${brandId}

    Step 2: Display prompts grouped by topic

    Let's create content from your tracked prompts.

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill can create drafts and publish content to a live site, but the top-level description and onboarding flow do not clearly warn that it performs external state-changing actions. In an agent setting, weak disclosure increases the risk that users invoke the skill without understanding it can modify production content, leading to accidental publication or reputational harm.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill instructs the parent agent to pass the raw `TPC_SESSION_TOKEN` into a general-purpose subagent prompt. That unnecessarily broadens credential exposure from a single trusted execution context to additional model contexts, increasing the chance of token leakage through logs, prompt inspection, tool traces, or misuse by the subagent. Because the token is a live session cookie, compromise enables authenticated actions as the user.

External Transmission

Medium

• Category: Data Exfiltration

Content

Returns SOV timeseries for a brand (optionally compared against a competitor).

```bash
curl -s "https://app.promptingco.com/api/v1/presence-rate?brandId=$TPC_BRAND_ID&timeframe=30d" \
  -H "Cookie: __Secure-better-auth.session_token=$TPC_SESSION_TOKEN"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Queues a draft for publishing to the live site.

```bash
curl -s "https://app.promptingco.com/api/v1/drafts/{draftId}/publish" \
  -X POST \
  -H "Cookie: __Secure-better-auth.session_token=$TPC_SESSION_TOKEN"
```

• Confidence: 78% confidence
• Finding: Although publishing to the vendor API is core functionality, this endpoint performs a live state-changing action that can affect the user's public site. In context, the issue is not external transmission per se but that the skill enables impactful publication using a session cookie and examples do not consistently enforce explicit confirmation or least-privilege safeguards before execution.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: These repeated workflow templates again direct disclosure of the live session cookie to general-purpose subagents for prompt tracking, publishing, and analytics. Repetition makes the unsafe pattern systematic rather than incidental, so any downstream subagent compromise or prompt leakage could expose a credential that authorizes read and write actions across the user's workspace.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly instructs users to use a live session cookie value (`__Secure-better-auth.session_token`) as an API credential, but provides no warning about treating it as secret authentication material. In an agent skill context, this is dangerous because users may paste browser session tokens into prompts, logs, or tool configurations, enabling account takeover if the token is exposed or reused.

Static analysis

No suspicious patterns detected.