bug-reproduction-brief
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill is a set of procedural instructions for software debugging. It includes explicit safety boundaries that warn against guessing credentials, publishing secrets, or modifying production data.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external bug reports, which are untrusted data sources.
- Ingestion points: Processes vague or environment-specific bug reports.
- Boundary markers: Instructions require separating expected from actual behavior and labeling second-hand descriptions as unverified, which helps isolate the agent from potentially malicious instructions in the bug report.
- Capability inventory: The skill involves environment inspection (commit, lockfiles, versions) and running minimal reproduction scripts.
- Sanitization: Explicitly instructs the agent to preserve logs without secrets or personal data.
- [COMMAND_EXECUTION]: To fulfill its purpose, the skill instructs the agent to inspect the repository environment (commit hash, runtime versions, dependency lockfiles) and run minimal reproduction scripts. These actions are within the expected scope of a bug reproduction task and are tempered by 'read-only discovery' guidelines.
Audit Metadata