investigate-last-crash
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a series of standard Linux diagnostic utilities including
journalctl,coredumpctl,sar, andlsto retrieve system state and logs. - [DATA_EXPOSURE]: The skill reads sensitive system information including kernel ring buffers and system logs. This behavior is entirely consistent with the primary purpose of a crash investigation tool and the results are stored locally in the user's home directory (
~/Daniel-Workstation-Updates/). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from system logs (
journalctl,coredumpctl) which could theoretically contain malicious instructions if a local process or remote service logged crafted strings. - Ingestion points: System logs via
journalctlandcoredumpctl(SKILL.md). - Boundary markers: Absent; log content is directly used to generate the report.
- Capability inventory: File write access to the local filesystem (SKILL.md).
- Sanitization: Absent; the skill extracts and quotes log lines without validation.
Audit Metadata