ClawHub
Back to skill

Security audit

Promptingco

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated Prompting Company purpose, but it relies on a sensitive browser session cookie, passes that cookie into subagent prompts, and can publish live content.

Review before installing. Only use this skill if you are comfortable giving an agent a live Prompting Company browser session cookie that can read workspace data and perform write actions such as creating prompts, approving items, and publishing drafts. Prefer a scoped API token if available, avoid pasting the cookie into chat or logs, and confirm the correct API host before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:219
Finding

Browser Session Credential Exposed to General-Purpose Subagents

Content
View full analysis
3. If duplicate exists, ask user if they want to continue 4. Fetch user personas: GET /api/v1/personas?brandId=${brandId} 5. Use the first persona as default (or let user select if multiple) 6. Create prompt with 4 conversation queries (one per engine): POST /api/v1/conversation-queries/bulk Body: { "brandId": "${brandId}", "queries": [ { "prompt": "", "model": "chatgpt", "maxTurns": 1, "userPersonaId": "", "userPersona": "" }, { "prompt": "", "model": "gemini", "maxTurns": 1, "userPersonaId": "", "userPersona": "" }, { "prompt": "", "model": "deepseek", "maxTurns": 1, "userPersonaId": "", "userPersona": "" }, { "prompt": "", "model": "sonar", "maxTurns": 1, "userPersonaId": "", "userPersona": "" } ] } 7. Confirm creation: "Created prompt tracked across ChatGPT, Gemini, DeepSeek, and Perplexity" Use the session token in all requests: -H "Cookie: __Secure-better-auth.session_token=${TPC_SESSION_TOKEN} ...[truncated 2126 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:20
Finding

Conflicting API Origins Can Cause Authenticated Requests to Reach an Unintended Host

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:583
Finding

User-Controlled Prompt Text Is Embedded Directly in a URL Query String

Content
View full analysis
``` ### Technical Analysis The Skill directs the agent to concatenate user-supplied prompt text into the `message` query parameter without requiring percent-encoding. Prompt text may contain `&`, `=`, `#`, `%`, spaces, line breaks, or other reserved characters. These characters can alter how clients, intermediaries, and the server parse the URL. For example, a prompt containing `&brandId=OTHER_VALUE` may introduce an additional parameter. The server's handling of duplicate parameters determines whether the injected value is ignored, appended, or used instead of the intended value. Query strings are also commonly retained by HTTP access logs, reverse proxies, monitoring systems, shell history, process listings, and task traces. Consequently, confidential prompt content may be disclosed even when TLS protects the request in transit. ### Attack Path 1. A user or attacker provides prompt text containing sensitive information or reserved URL characters. 2. The agent substitutes that text directly into the documented URL. 3. The HTTP client parses reserved characters as query delimiters rather than as part of the prompt. 4. The server receives malformed, truncated, or attacker-influenced query parameters. 5. Infrastructure components record the complete URL, exposing the prompt content to log ...[truncated 668 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill asks the user to supply a live browser session cookie value, but it does not provide a meaningful safety warning about the sensitivity of that credential or the risks of sharing it with an agent workflow. Session cookies are equivalent to authenticated access, so collecting them without explicit caution raises the risk of credential mishandling, replay, or over-collection.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 952)May include surrounding context.

md
- GET https://app.promptingco.com/api/v1/prompt-topics?brandId=${brandId}
    - For each topic: GET https://app.promptingco.com/api/v1/prompt-topics/{topicId}/prompts?brandId=${brandId}

    Step 2: Display prompts grouped by topic

    Let's create content from your tracked prompts.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill can create drafts and publish content to a live site, but the top-level description and onboarding flow do not clearly warn that it performs external state-changing actions. In an agent setting, weak disclosure increases the risk that users invoke the skill without understanding it can modify production content, leading to accidental publication or reputational harm.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the parent agent to pass the raw TPC_SESSION_TOKEN into a general-purpose subagent prompt. That unnecessarily broadens credential exposure from a single trusted execution context to additional model contexts, increasing the chance of token leakage through logs, prompt inspection, tool traces, or misuse by the subagent. Because the token is a live session cookie, compromise enables authenticated actions as the user.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

Returns SOV timeseries for a brand (optionally compared against a competitor).

bash
curl -s "https://app.promptingco.com/api/v1/presence-rate?brandId=$TPC_BRAND_ID&timeframe=30d" \
  -H "Cookie: __Secure-better-auth.session_token=$TPC_SESSION_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

Although publishing to the vendor API is core functionality, this endpoint performs a live state-changing action that can affect the user's public site. In context, the issue is not external transmission per se but that the skill enables impactful publication using a session cookie and examples do not consistently enforce explicit confirmation or least-privilege safeguards before execution.

Content

Scanner excerpt · SKILL.md (reported line 667)May include surrounding context.

Queues a draft for publishing to the live site.

bash
curl -s "https://app.promptingco.com/api/v1/drafts/{draftId}/publish" \
  -X POST \
  -H "Cookie: __Secure-better-auth.session_token=$TPC_SESSION_TOKEN"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

These repeated workflow templates again direct disclosure of the live session cookie to general-purpose subagents for prompt tracking, publishing, and analytics. Repetition makes the unsafe pattern systematic rather than incidental, so any downstream subagent compromise or prompt leakage could expose a credential that authorizes read and write actions across the user's workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide explicitly instructs users to use a live session cookie value (__Secure-better-auth.session_token) as an API credential, but provides no warning about treating it as secret authentication material. In an agent skill context, this is dangerous because users may paste browser session tokens into prompts, logs, or tool configurations, enabling account takeover if the token is exposed or reused.

Content

No source excerpt is available for this finding.