The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to use a fetch POST to a "debug API route" for browser-side instrumentation. Because the destination URL is not explicitly defined within a safe scope, an agent could potentially be directed to exfiltrate sensitive runtime data to an external or unauthorized endpoint.
[COMMAND_EXECUTION]: The analysis phase (Phase 4) explicitly instructs the agent to use shell commands like wc, ls, tail, and grep to process log files. This introduces a surface for command-line interactions triggered by the contents of the local filesystem.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it reads and processes data from a log file that captures application execution state, which often includes user-controlled input.
Ingestion points: The agent reads the {project_root}/.claude/debug.log or /tmp/.claude/debug.log file in Phase 4 using shell utilities.
Boundary markers: The instructions lack delimiters or escape sequences to prevent the agent from interpreting logged data as instructions.
Capability inventory: The agent is empowered to modify source code across the project (Phase 3 and 5), execute shell commands (Phase 4), and perform network operations (Phase 3).
Sanitization: There are no instructions provided to sanitize, validate, or filter the content of the logs before the agent processes them.
[DATA_EXFILTRATION]: The use of a hardcoded path in a shared temporary directory (/tmp/.claude/debug.log) for fallback logging creates a risk of local information exposure or predictable file location attacks in multi-user environments.

debug-mode