diagnosing-bugs
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to be 'aggressive' and 'creative' in building feedback loops, which involves executing arbitrary shell commands, HTTP scripts, and headless browser tests (Playwright/Puppeteer). This provides a large attack surface if the agent is directed toward malicious endpoints or local files.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from multiple sources including user bug reports, trace replays, HAR files, and log dumps (documented in Phase 1). This untrusted data is processed in a context where the agent is authorized to perform high-capability actions like file writing and command execution without mandatory sanitization or boundary markers.
- [DATA_EXFILTRATION]: The
scripts/hitl-loop.template.shutility captures human input (e.g., error messages, status) and prints it to the terminal for the agent to parse. If a user inadvertently includes sensitive information (secrets, PII) in these responses, that data is exposed to the agent's context and any subsequent network operations defined in the diagnostic loop.
Audit Metadata