doctor

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [DATA_EXPOSURE]: The skill accesses the local configuration file ~/.promptbook/config.json which contains sensitive information, including a private API key, to verify setup integrity.
  • Evidence: API_KEY=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$HOME/.promptbook/config.json','utf8')).api_key)")
  • [DATA_EXFILTRATION]: The skill transmits the retrieved API key to the developer's official endpoint (https://promptbook.gg) for validity testing. This is the intended behavior for the diagnostics command and targets the vendor's own infrastructure.
  • Evidence: curl -sL -o /dev/null -w "%{http_code}" -X POST "https://promptbook.gg/api/auth/verify-setup" -H "Authorization: Bearer $API_KEY"
  • [COMMAND_EXECUTION]: The skill uses node -e to execute inline JavaScript for parsing JSON configuration and curl for making network requests to the vendor API.
  • Evidence: node -e "const c=JSON.parse(require('fs').readFileSync('$HOME/.promptbook/config.json','utf8'));..."
  • [COMMAND_EXECUTION]: Uses standard system utilities stat and ls to inspect file permissions and verify the presence of session activity logs in ~/.promptbook/sessions/.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 02:12 PM
Security Audit — agent-trust-hub — doctor