windsurf-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the
!commandsyntax to automatically execute and display system environment details (Windsurf version, Node.js version, anduname -aoutput) when the skill is loaded. - [COMMAND_EXECUTION]: The skill includes several shell scripts that automate the collection of configuration data and logs. These commands include directory traversal, log tailing, and archiving using
tar. - [DATA_EXFILTRATION]: The skill accesses sensitive application paths, including
~/.codeium/and platform-specific log directories (e.g.,~/Library/Application Support/Windsurf/logs). It includes explicitsedroutines to redactBearertokens and other sensitive identifiers from the collected data to prevent accidental exposure of credentials in the resulting debug bundle.
Audit Metadata