Prompt Marketplaces and Public Prompt Collections

Public prompt collections are useful for finding task structures and examples, but a prompt pulled through an SDK may include a serialized manifest with model configuration or LangChain objects. LangSmith’s documentation describes its public hub as community-created and warns that entries are user-generated, unverified, and not reviewed or endorsed. That statement applies to this hub; it should not be generalized to every prompt marketplace. More importantly, copying visible text and pulling a public manifest into an application are different trust decisions. The LangSmith SDK maintainers published GitHub advisory GHSA-3644-q5cj-c5c7 for public prompt pulls that deserialize untrusted manifests without an explicit trust-boundary warning. The advisory explains that a manifest may configure model endpoints, headers, or other constructor arguments, and may deserialize prompt or runnable objects. In affected workflows, a malicious public manifest could redirect requests to an attacker-controlled base URL or proxy and expose prompt contents, retrieved context, credentials, or other request data. The vulnerability applies when an application pulls a public owner/name prompt, the source is untrusted or compromised, and the application uses the manifest without independent review. It is not a claim that simply viewing a prompt in the web hub causes this impact. The advisory lists patched versions: Python langsmith 0.8.0 and later, JavaScript/TypeScript langsmith 0.6.0 and later, langchain 0.3.30 and later, and langchain-classic 1.0.7 and later. Patched SDKs block public owner/name pulls by default; callers must explicitly opt in with dangerously_pull_public_prompt or dangerouslyPullPublicPrompt. Do not treat that opt-in as a trust check. Review the manifest and source, pin an approved commit rather than relying on a moving latest reference, avoid include_model and secrets_from_env for untrusted sources, and keep credentials scoped. Apply code review, version control, testing, and audit practices as you would for executable configuration. Same-organization prompts also need access controls and review if credentials or accounts could be compromised.