@getpromptly/cli@0.2.11
Developer prompt analytics CLI - capture and review AI coding sessions
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s disclosed, gated telemetry limits the concern, but its PostHog client also enables exception autocapture without describing that collection in its telemetry status text. This is a warning-level telemetry concern; the source does not show what exception fields the SDK sends.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI operation initializes analytics while cloud mode is active, a token is configured, and telemetry has not been disabled.
Impact
Uncaught exception details or stack data could be sent beyond the stated telemetry fields; the source does not establish exactly what the SDK captures.
Mechanism
The PostHog client enables exception autocapture, while the package describes active telemetry as event names, version, and OS only.
AI rationale
The package’s disclosed, gated telemetry limits the concern, but its PostHog client also enables exception autocapture without describing that collection in its telemetry status text. This is a warning-level telemetry concern; the source does not show what exception fields the SDK sends.
Evidence
dist/analytics.js~/.promptly/config.json
Network endpoints2
eu.i.posthog.comPOSTHOG_HOST (user-configurable)
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The PostHog client is configured with `enableExceptionAutocapture: true`.
- The telemetry status text describes collection as event names, version, and OS only, with no prompt content or file paths.
- Runtime telemetry is gated on cloud mode and a login, and can be disabled through configuration or environment variables.
- The manifest declares no install lifecycle scripts; the package is exposed as an explicit CLI.
Evidence against
- The package discloses its one-time install ping and says it sends version and OS only, with an opt-out.
- The flagged agent skill writes are reached through an explicit skill installation command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/commands/login.jsView file
27package = @getpromptly/cli; repositoryIdentity = promptly; dependency = open
L27: try {
L28: const open = (await import("open")).default;
L29: await open(verificationUrl);
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/commands/login.jsView on unpkg · L27dist/commands/skill.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
n iscodexconfigured() {
const configpath = path.join(os.homedir(), ".codex", "config.toml");
try {
if (!fs.existssync(configpath))
return false;
const content = fs.readfilesync(configpath, "utf-8");
return content.includes("[mcp_servers.promptly]");
}
catch {
return false;
}
}
export function isgeminiinstalled() {
try {
execsync("gemini --version", { stdio: "ignore" });
return true;
}
catch {
return false;
}
}
export function isgeminiconfigured() {
const configpath = path.join(os.homedir(), ".gemini", "settings.json");
try {
if (!fs.existssync(configpath))
High
Findings
2 High5 Medium5 Low
HighCopied Package Dependency Bridgedist/commands/login.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/commands/skill.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/analytics.js
MediumAi Review Evidencedist/analytics.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @getpromptly/cli@0.2.11.
See all versions of @getpromptly/cli for other recorded verdicts.
- Review the evidence and your use of @getpromptly/cli@0.2.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.