juicebox-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes diagnostic shell commands to gather environment context for the debug bundle, including node -v, npm -v, and uname -a.- [DATA_EXFILTRATION]: The skill collects environment information, API status headers, and account quota metadata from api.juicebox.ai. It also accesses local application logs from logs/app.log. While these are non-whitelisted operations, they are consistent with the skill's primary purpose of creating a diagnostic support bundle. The skill includes explicit logic to mask the JUICEBOX_API_KEY before inclusion in text reports.- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from local log files and external API responses to populate the diagnostic archive.
  • Ingestion points: Local file logs/app.log and JSON responses from api.juicebox.ai/v1/* endpoints.
  • Boundary markers: The skill does not use specific delimiters when appending log content to text files, but the output is intended for manual support review rather than immediate re-processing by the agent.
  • Capability inventory: Includes file system write capabilities (tar, redirection, fs.writeFileSync) and network access via curl.
  • Sanitization: Implements API key masking (${JUICEBOX_API_KEY:0:10}...) to prevent credential leakage in the generated logs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:45 AM