report-bug
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Ruby scripts (lib/buttercut/report.rb) to verify user consent and submit sanitized bug reports.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data from system errors and stack traces, which represents a vulnerability surface for indirect prompt injection.\n
- Ingestion points: Crash logs, stack traces, and library metadata processed during report generation.\n
- Boundary markers: While the skill provides strict sanitization rules, it lacks explicit boundary delimiters to prevent the agent from following instructions embedded in error data.\n
- Capability inventory: Shell command execution via Ruby and file system modifications to libraries/settings.yaml.\n
- Sanitization: Step 3 defines mandatory redaction of absolute file paths, user names, and quoted content from transcripts or summaries.
Audit Metadata