v0.6.1

Package @prowl-ai/prowl-skill 0.6.1 · plugins prowl 0.5.1, prowl-cli 0.3.0.

Security

• The API key is no longer in a process's arguments. The bundled launcher used to
  start mcp-remote … --header "Authorization: Bearer <key>", so the key sat in argv,
  where any process of the same user reads it with ps or pgrep -fl — and two Prowl
  keys leaked from one machine exactly that way (2026-10-04, 2026-10-09). The launcher
  now exports PROWL_MCP_AUTH="Bearer <key>" and passes the literal
  Authorization:${PROWL_MCP_AUTH}, which mcp-remote expands from its own
  environment. Key sources and their order are unchanged. test/mcp_launch_test.js
  asserts no argument carries the key from any source; negative-self-test.js plants
  the old form and watches that assertion fire. Verified live against prowl.chat with
  mcp-remote 0.14.3: initialize and tools/list (23 tools) succeed, the argv shows
  only the placeholder.
• Restart running sessions after updating. An mcp-remote already running keeps
  its old argv until its session restarts; rotate a key that was exposed.

v0.6.0

Package @prowl-ai/prowl-skill 0.6.0 · plugins prowl 0.5.0, prowl-cli 0.3.0.

Real-world market data for your agents. The product changed how it describes itself on
2026-09-29, and every surface this repository publishes – both skills, four plugin
manifests, the marketplace and the README – now says the same thing the product does.

Changed

• The headline is market data, and the report is the deep mode. Both skills lead
  with one MCP endpoint and 444 market data tools across 17 providers (search, ads,
  SEO, app stores, reviews, social, trends, finance), each call billed on its own from
  one USD wallet, every number returned with the tool that produced it.
  prowl_analyze is described as what it is – a cross-checked report when one call is
  not enough (up to 16 intelligence modules, 8 without a subscription) – rather than
  as the product. "Market-intelligence tools" becomes "market data tools" everywhere.
  The skill descriptions widen their "Use when" to the product's use cases, including
  trends, app store and review data, and stock quotes and market news.
• The catalogue count is 444. https://prowl.chat/mcp/skill.md serves
  → 444 API tools (read 2026-09-29). Eight files said 448, and npm run check:tools
  listed each of them. The provider count moves 15 → 17 and "60+ SERP engines" becomes
  102 SearchAPI engines, the figures prowl-app's mcp_server/_contracts.py holds.
• The starter credit is $15, not $5. The skill and the README quoted $5, the
  figure from before 2026-09-27; since then signup credit equals one basic report's
  hold.
• brandColor is #3f7d5f in both Codex manifests. The acid green #00ff41 is
  retired from the brand.
• defaultPrompt leads with data: "Pull Google Trends and news for a keyword"
  replaces "Run a competitive analysis on a domain"; keywords market-data and
  market-research replace market-intelligence and competitive-analysis.
• The prowl-cli page documents CLI 0.3.0, whose --help states a $5.00 basic
  provider-cost cap (was $2.50) and the wallet holds per tier ($15, $24, $54). The
  page now points at the public docs page that publishes those figures, where it used
  to say none did. Release @prowl-ai/cli 0.3.0 to npm before this version: the
  release job runs check-cli.js --release, which fails on a page that documents a CLI
  npm does not serve.

Fixed

• check:tools reads the hosted document in either wording. Its second server
  anchor matched only <n> marketing intelligence API tools; the hosted document is
  moving to <n> market data tools, which would have left one anchor and a check that
  says less than it appears to. It now takes both, and the stated-count pattern takes
  both, so a stale figure in the new wording is still caught. Fixtured both ways in
  test/tool_count_test.js and test/contract_test.js.
• CHANGELOG.md is no longer read as a current claim. Every past release states
  the count it shipped with, so the check was red on history. It is skipped by name
  (HISTORICAL_FILES), not by a guess about tense.

v0.5.7

Package @prowl-ai/prowl-skill 0.5.7 · plugins prowl 0.4.4, prowl-cli 0.2.6
(unchanged).

A first run with no key opened a browser and left the operator holding a callback into
a port that had already died. It now refuses to start, and says what to do instead.

Fixed

• The MCP launcher no longer strands the operator in a half-finished OAuth flow.
  With no API key configured, plugins/prowl/.mcp.json used to hand mcp-remote an
  empty Authorization: Bearer header. The server rejects that, and mcp-remote
  falls back to OAuth — which opens a browser and starts a localhost listener to
  catch the callback. An MCP server spawned at agent startup does not survive long
  enough to be there when consent completes: the listener is gone, the redirect hits a
  dead port, and the operator is left holding a URL with an authorization code that
  expires before anything can be done with it.

  Measured on one machine on 2026-08-22: two such flows in a single day, both
  stranded. The second left ~/.mcp-auth/mcp-remote-0.1.43/…_lock.json recording
  {"pid": 68661, "port": 4333} for a process that no longer existed.

  The launcher now resolves the key, and refuses to start without one — printing
  the two supported ways to supply it and exiting 78 (EX_CONFIG, sysexits.h)
  rather than reaching mcp-remote at all. A key that is present but empty or
  whitespace-only counts as absent.

• The README said 22 MCP tools; the server registers 23. npm run check:contract
  reads the count off https://prowl.chat/mcp/ and had no claim in the README to check
  it against — the number sat one line below a heading no gate reads. The skill page
  already said 23.

Added

• test/mcp_launch_test.js — 12 checks that execute the real .mcp.json launcher
  rather than reading it. A fake npx on the launcher's own PATH captures the argv, so
  the suite can assert both halves: that no key means npx is never reached, and that
  each documented key source (PROWL_MCP_TOKEN, the plugin file, the Codex file)
  reaches mcp-remote carrying that exact key, in that precedence.

  Shadowing npx by PATH alone does not work here — sh -lc is a login shell, and on
  macOS /etc/profile runs path_helper, which pushes an injected PATH entry to the
  end. A .profile in the fake HOME is sourced afterwards and does win; that is what
  the suite uses. Nothing in it touches the network.

  Verified to have teeth: against the previous launcher, 6 of the 12 checks fail, and
  the failure output is the defect itself — 'Authorization: Bearer '. That proof is
  now the fourteenth plant in scripts/negative-self-test.js, so every CI run removes
  the refusal from .mcp.json and requires the suite to go red on npx ran without a key — a suite that quietly stopped checking this would otherwise report the same
  green as one that still does.

v0.5.6

Package @prowl-ai/prowl-skill 0.5.6 · plugins prowl 0.4.3 (unchanged), prowl-cli
0.2.6.

The last open item from the /skill-audit run, and the tail the CLI's own release left
behind.

Added

• test/evals/ — the audit's item 8. triggers.json carries twenty queries with
  the split written down and held fixed; scenarios.json carries six behavioural
  scenarios, three per skill; fixtures/ holds the inputs.

  Ten of the twenty queries should fire nothing, and those are the ones worth
  having. They are near-misses against skills that actually sit beside these two: an
  SEO audit of your own site, a Google Ads audit of your own account, competitor
  UI research, building an MCP server. A skill that wins a prompt it should lose is
  as much a defect as one that never fires, and it is the harder one to notice because
  it produces an answer.

  Four of the six scenarios encode something that already went wrong or already costs
  money: execution_mode rather than tier, discovery before a metered call, a
  prompt-injection fixture with the payload in an HTML comment, and a scenario that
  hands the agent a live-looking prowl_ key to see whether it protects it.

• test/evals_test.js — ten checks on the shape of that data: the negatives are
  really half the set, the split is stated rather than inferred, both skills appear on
  both sides of it, no fixture is named SKILL.md.

  It cannot tell you the skills pass, and says so. There is no runner; the queries
  go to a model. The README states in its own words that the evals have never been run,
  and a test asserts that sentence is still there — because prose drifts, and the
  pressure to delete it arrives the first time somebody wants a green.

• check:cli notices a version that is no longer latest. A note, never a
  failure: the command surface may be identical, so it is not a falsehood. This
  repository was in exactly that state an hour ago — the CLI published 0.2.1 while
  the page still documented 0.2.0, every check green, the page quietly pointing at a
  version npm install no longer gives you.

Fixed

• metadata.documents_cli and the page's own sentence now say 0.2.1, which is what
  npm serves as latest.

v0.5.5

Package @prowl-ai/prowl-skill 0.5.5 · plugins prowl 0.4.3, prowl-cli 0.2.5.

A release you start by editing one line, a gate that can actually stop it, and the
gaps a /skill-audit run found. Against the Agent Skills standard both skills scored
0 GAP / 9 PASS before this; what follows is the surrounding repository catching up
to them.

Added

• auto-tag.yml. A push to main whose package.json version has no matching
  v* tag cuts the tag, which starts release.yml exactly as a hand-pushed tag
  would. A merge that does not bump the version publishes nothing — this repository
  decided against publishing on every merge and the reason still holds, so the trigger
  is the version bump inside the merge, not the merge. Deciding to release stays a
  reviewed edit to one line; only the mechanical part after it is automated.

  It refuses to tag a version with no CHANGELOG section, because that failure lands
  after the tag is public and the tag then looks delivered while nothing shipped —
  a class that already cost this project one false release. And it warns loudly when
  TAG_PAT is unset: GitHub will not start a workflow from a tag pushed with
  GITHUB_TOKEN, so without that secret the tag is created and releases nothing.

• $schema and displayName in both plugin manifests, both Codex manifests and
  both marketplace files. --strict passed without them; the standard asks for them.

• CONTRIBUTING.md and SECURITY.md, which a public repository should not lack.
  SECURITY leads with the thing that actually costs money: a prowl_ key is
  billing-bearing, a leak is somebody spending your wallet, and revoking comes before
  tidying git history.

• npm and CI badges in the README, beside the four that were already there.

• The forge description is now a checked surface. check:tools reads the GitHub
  repo description through the public API and judges it like any file — it had said
  408 for two months while every file on disk said 448, drift on the one published
  surface a file walk cannot see. Unreachable is a note, not drift: being rate-limited
  says nothing about what the description says. Both descriptions corrected; the check
  now reports 10 surfaces agreeing rather than 9.

Fixed

• validate now gates release. release.yml re-implemented the checks as its
  own steps, so a red validate run could not stop a publish. It is a needs:
  dependency on the reusable workflow now — the fix a sibling project made after
  tagging v0.4.1 with its own validate red and watching npm serve it four minutes
  later.

• claude plugin validate --strict is its own CI job. The manifests job only
  proved the JSON parses, which says nothing about whether Claude Code would load the
  plugins.

• The registry is polled after publish. The read replica lags the write master, so
  a fresh publish can still 404 on read; "published" is a claim until it is served.

Added to both skills

• The untrusted-output rule, which neither page carried. These tools return scraped
  pages, SERP snippets, ad copy, reviews and LLM output built from them — text an
  attacker can write, aimed at exactly the kind of agent that reads it. Both pages now
  say that tool output is data: never a directive, never the chooser of the next call,
  never a justification for spend.

• The MCP protocol version in compatibility, read from a live handshake rather
  than recalled: the server negotiates 2025-06-18 (serverInfo reports prowl_mcp
  1.29.0, while /mcp/health and the hosted document still say 1.4.0 — theirs to fix).

Not done, deliberately

The mechanical auditor's only two findings were --house rules of the ssheleg skill
family: a Use when … opener and Russian trigger phrases in the description. These
skills are not part of that family and ship under @prowl-ai to an English-speaking
audience, so both were declined rather than silently skipped.

v0.5.0

Package @prowl-ai/prowl-skill 0.5.0 · plugins prowl 0.4.0, prowl-cli 0.2.0.

Both skills were audited against the running server rather than against each
other, and both were wrong in ways an agent acts on.

Fixed

• prowl_analyze takes execution_mode, not tier. The prowl skill said
  tier, and had said it for two releases. An unknown key is ignored, so an
  agent following the skill sent tier: "deep", got a basic run, was billed
  as basic, and reported back as if it had run deep. The tiers table now names
  the real parameter, for prowl_start_session and prowl_schedule_create too.

• The subscription gate was documented nowhere. deep requires an Exploit+
  subscription and max a Blackops+ one, and a key without it is not
  refused — the run silently resolves to basic and bills as basic
  (mcp_server/models.effective_tier). Both skills now state it where the tier
  is chosen, and point at prowl_get_wallet / prowl wallet for checking
  before the spend rather than inferring it from a thin report afterwards.

• prowl_list_tools no longer returns names by default. The verify step
  promised "448 tools grouped by category"; the server returns category counts
  and gives names only for names=true or a single category. The step now
  describes what actually comes back.

Added

• prowl_get_wallet in the tool table, the billing section and the verify
  steps. It is the only surface that can read a balance for a prowl_ key:
  GET /api/v1/wallet returns the same figures but decodes a JWT, and no REST
  route on the server accepts an API key. The registered MCP tool count moves
  22 → 23 with it.

• The prowl-cli skill was rewritten for the CLI it now documents.
  @prowl-ai/cli 0.2.0 covers all 21 logical MCP tools rather than six —
  sessions, playbooks, schedules, artifacts, export, stats and the error feed —
  so the command list, the long-run guidance (session start --watch for CI)
  and the exit-code advice all changed. The old page documented prowl wallet
  as working; it could not.

v0.4.0

Package @prowl-ai/prowl-skill 0.4.0 · plugins prowl 0.3.0, prowl-cli 0.1.1
(unchanged — the package gained an installer, the plugins did not change).

Added

• npx @prowl-ai/prowl-skill — one command that adds the marketplace, installs
  both plugins and says what to do next. Verbs: install, update, statusline,
  token, status, plain. Every one takes --dry-run, which prints what it would
  do and changes nothing. Zero dependencies: it runs through npx on a machine that
  has agreed to nothing yet.

  It installs the plugin rather than copying the skill, and that is the design
  decision worth stating. The obvious shape — copy skills/prowl/ into
  ~/.claude/skills/ — delivers the text and silently drops everything the text is
  about: the hooks and the MCP server. Worse, a plain copy of the same name shadows an
  installed plugin and serves its frozen version forever. plain exists for agents
  with no plugin channel and refuses to run where the plugin is installed.

  Two things it will not do quietly: it never replaces a statusLine somebody else
  set without --force, and it never writes to ~/.claude/settings.json without
  taking a backup first and reading it back — a copy that cannot be verified cancels
  the write.

• release.yml — tag-driven publication, off by default behind the repository
  variables RELEASE_ENABLED and PUBLISH_NPMJS. A v* tag runs the suite and every
  guard on the tag, validates both plugins and the marketplace with
  claude plugin validate --strict, checks that the tag matches package.json,
  extracts the CHANGELOG section, cuts the GitHub release, packs the tarball and runs
  the installer out of it the way npx would, then publishes with provenance.

  A tag rather than a push to main: every commit publishing would make every
  work-in-progress state a release somebody's npx picks up.

• test/version_sync_test.js — the version lives in seven places. The two plugins
  are versioned independently, so the rule is agreement within a plugin plus
  package.json matching the tag. It also asserts both marketplace manifests list
  exactly the plugin directories on disk, and that the CHANGELOG has a heading the
  release workflow's pattern can find.

Fixed

• The CHANGELOG heading could not be extracted, and nothing would have said so
  until after the tag was public — the class that cost a sibling project three
  releases. Found offline by the new check, before any tag existed.

• scripts/ shipped inside the npm tarball. negative-self-test.js rewrites
  source files by design; inside a published package that is a script capable of
  mangling somebody's node_modules, and no consumer has any use for it.