helmor-debug-operate
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill monitors and processes UI data such as accessibility trees and logs which may contain content from untrusted external sources, creating an indirect prompt injection attack surface.\n
- Ingestion points: Data is ingested from the application webview using
webview_dom_snapshotandread_logs(SKILL.md).\n - Boundary markers: The instructions lack explicit delimiters or warnings to treat UI-derived content as potentially untrusted data.\n
- Capability inventory: The agent has access to highly capable tools including
webview_execute_js,webview_interact, andwebview_keyboardwhich can be used to alter the application state (SKILL.md).\n - Sanitization: Content retrieved from the application is not sanitized or validated before being used for subsequent agent reasoning.\n- [COMMAND_EXECUTION]: The skill employs custom JavaScript shims to interact directly with the application's internal messaging and element resolution systems.\n
- A custom "Call App Commands" helper allows the agent to execute internal Tauri IPC commands by directly accessing
window.__TAURI_INTERNALS__.ipc, bypassing limitations in the standard communication bridge.\n - The skill injects a "Selector Repair" script into the application's JavaScript environment to modify element resolution behavior at runtime.
Audit Metadata