vibe-debug
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is centered around executing shell commands to build feedback loops and verify bugs.
- Mentions the use of
git bisect run,curl, and various test runners (unit, e2e, integration) inSKILL.md(Phase 1). - Utilizes a helper script
scripts/hitl-loop.template.shto facilitate human-in-the-loop debugging. - [EXTERNAL_DOWNLOADS]: The skill interacts with network resources and external data files.
- Instructions include using
curlagainst development servers for reproduction (Phase 1). - The skill processes external artifacts such as HAR files, log dumps, and captured network traces.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface due to its processing of untrusted external data.
- Ingestion points: The skill reads external data including logs, traces, and HAR files which could contain embedded instructions (Phase 1).
- Boundary markers: No explicit delimiters or warnings to ignore instructions within ingested data are defined.
- Capability inventory: The agent has extensive shell execution capabilities and file system access within the project scope (Phase 1, Phase 5).
- Sanitization: No sanitization steps are specified for data before it is processed or used in terminal commands.
Audit Metadata