telescope-debugging
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of shell commands, specifically
php artisan telescope:list,php artisan telescope:show, andjq. These commands are used to retrieve and parse debugging information from the local environment. There is no evidence of these commands being used for external network operations or unauthorized file access outside the scope of the Laravel project. - [INDIRECT_PROMPT_INJECTION]: The skill processes log data that originates from external application interactions (web requests, queued jobs, etc.), which creates a surface for indirect prompt injection if an attacker can influence what Telescope records.
- Ingestion points: Data is ingested via the output of
php artisan telescope:listandphp artisan telescope:showas described inSKILL.md. - Boundary markers: The instructions do not define specific delimiters to isolate the log data from the agent's internal reasoning, though the use of
--jsonoutput provides a structured format. - Capability inventory: The agent has the capability to execute shell commands (
php artisan,jq) to read and manipulate this data. - Sanitization: The skill utilizes
jqto filter and extract specific JSON fields (e.g.,content.sql,content.message), which provides a layer of structured data handling rather than processing raw, unvalidated text.
Audit Metadata