doctor
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXPOSURE]: The skill accesses the local configuration file
~/.promptbook/config.jsonwhich contains sensitive information, including a private API key, to verify setup integrity. - Evidence:
API_KEY=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$HOME/.promptbook/config.json','utf8')).api_key)") - [DATA_EXFILTRATION]: The skill transmits the retrieved API key to the developer's official endpoint (
https://promptbook.gg) for validity testing. This is the intended behavior for the diagnostics command and targets the vendor's own infrastructure. - Evidence:
curl -sL -o /dev/null -w "%{http_code}" -X POST "https://promptbook.gg/api/auth/verify-setup" -H "Authorization: Bearer $API_KEY" - [COMMAND_EXECUTION]: The skill uses
node -eto execute inline JavaScript for parsing JSON configuration andcurlfor making network requests to the vendor API. - Evidence:
node -e "const c=JSON.parse(require('fs').readFileSync('$HOME/.promptbook/config.json','utf8'));..." - [COMMAND_EXECUTION]: Uses standard system utilities
statandlsto inspect file permissions and verify the presence of session activity logs in~/.promptbook/sessions/.
Audit Metadata