meteor-debugging
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data sources during the debugging process, such as application logs, build output, and browser traces, which could theoretically contain malicious instructions.
- Ingestion points: SKILL.md and references/tests-and-browser.md describe reading server logs, browser console output, and Playwright traces.
- Boundary markers: The skill mandates labeling logs by runtime side and operation to maintain context.
- Capability inventory: The agent has access to meteor shell and playwright-cli for diagnostics.
- Sanitization: The instructions strictly forbid logging sensitive information (credentials, tokens, private settings) and require redaction.
- [EXTERNAL_DOWNLOADS]: The skill mentions the use and potential installation of external tools like playwright-cli and Android SDK platforms.
- Evidence: Found in references/tests-and-browser.md and references/mobile-and-production.md.
- Mitigation: The skill includes explicit instructions to check tool availability and request user authorization before any installation or download occurs.
Audit Metadata