report-bug
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Ruby script
lib/buttercut/report.rbto check user consent and perform the bug reporting action. - [DATA_EXFILTRATION]: The skill transmits bug reports and execution context to the developer's team. Although it includes explicit instructions for user consent and data scrubbing, the primary function is the external transmission of information derived from the local environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from command failures, such as stack traces and error messages, which could contain sensitive information or attempt to influence agent behavior.
- Ingestion points: Error messages, crash reports, and stack traces generated by ButterCut commands (Step 1).
- Boundary markers: Not present for input data; the skill relies on the agent to correctly identify and strip data before processing.
- Capability inventory: Network transmission and file modification capabilities via the
ruby lib/buttercut/report.rbscript and direct editing oflibraries/settings.yaml(Step 2 and Step 4). - Sanitization: Explicit instructional guidelines (Step 3) command the agent to remove file paths, clip names, transcripts, and personal/company names before passing the data to the reporting script.
Audit Metadata