dev-loop-debugging-strategy

Warn

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill exhibits an extreme volume of redundant content across eight reference files (e.g., testing-strategies.md, architecture-patterns.md, state-management.md). Each file contains 150 sections consisting of the same technical boilerplate. This context-stuffing technique serves no functional purpose and is typically used to fill an agent's context window or obscure other instructions.
  • [PROMPT_INJECTION]: The skill processes untrusted user data via bug reports and root cause analysis documents using implementation patterns defined in SKILL.md.
  • Ingestion points: User-supplied titles and descriptions are parsed by the BugReport and RCADocument classes in SKILL.md.
  • Boundary markers: No delimiters or warnings to ignore embedded instructions are present in the parsing logic.
  • Capability inventory: The skill has access to powerful tools and commands including git bisect, kubectl logs, npm run build, npx jest, and various debuggers (gdb, jstack).
  • Sanitization: There is no filtering or validation of the input text before it is interpolated into the agent's workflow.
  • [COMMAND_EXECUTION]: Instructions in references/remote-debugging.md direct the user to use sudo to modify sensitive kernel parameters (core_pattern) and manage core dump generation at a system level.
  • [COMMAND_EXECUTION]: The skill provides automated scripts in SKILL.md that execute local shell commands, including git bisect run, npm run build, and npx jest, which are triggered during the debugging workflow.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing various third-party debugging tools and libraries, such as debugpy via pip, the delve debugger for Go, and multiple OpenTelemetry observability packages via npm.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 8, 2026, 12:21 PM
Security Audit — agent-trust-hub — dev-loop-debugging-strategy