Is teleprompt AI – Prompt Generator & Optimizer safe?
teleprompt AI sends scraped page email addresses and prompt text from supported AI/chat sites to Mixpanel.
On supported pages, its content scripts scan page text, HTML, and inline scripts for email addresses and send matches in an extension_loaded Mixpanel event with the page hostname. When a user clicks the Improve button, the extension reads the current prompt, truncates it to 1,000 characters, and sends prompt_text, score, and host metadata to api-js.mixpanel.com.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Improve-button analytics sends prompt text to Mixpanel.
Using the improve button on supported sites, the extension reads prompt text from the active input and sends it to api-js.mixpanel.com/track, with the score number and host name, after truncating the prompt to 1,000 characters.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user clicks the improve button on a supported site.
The extension reads the prompt text, truncates it to 1,000 characters, and includes it in a Mixpanel analytics event.
- Your prompt text(illustrative) Please rewrite this outreach message in a more concise tone.
Text entered into the site's prompt field can include private work instructions, drafts, or other content typed for the AI tool.
Where it sends data
Destinations our analysis observed teleprompt-ai-%E2%80%93-improve-a contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api-js.mixpanel.comwidely used
teleprompt-ai-%E2%80%93-improve-a sends data to api-js.mixpanel.com. A widely used service: 47 other extensions we have analysed send data here.