vibe-coding-debug
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and analyzing untrusted external data, including user bug reports, system logs, and error messages (SKILL.md, references/investigation.md).
- Ingestion points: Bug descriptions, log files, console output, and network request/response data are processed during the investigation phase.
- Boundary markers: There is no evidence of explicit boundary markers being used to encapsulate untrusted data when it is provided to the agent.
- Capability inventory: The skill has the capability to write to the file system (modifying source code and logs) and execute other tools and test suites (references/fix-protocol.md).
- Sanitization: No sanitization or validation logic for the external input is described, relying instead on the agent's internal reasoning and manual user approval.
- [COMMAND_EXECUTION]: The skill executes commands to reproduce bugs and verify fixes, including running test suites and impact analysis tools (references/fix-protocol.md, references/investigation.md). While these are standard debugging activities, they are performed based on the analysis of untrusted inputs.
Audit Metadata