debug-live
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- Dynamic Execution via Debugger Tools: The skill instructs the agent to use tools like
evaluate_expressionto run code within a live debug session. While this involves dynamic execution, it is the intended purpose of the skill to allow the agent to test hypotheses and inspect runtime state during debugging. - Indirect Prompt Injection Surface: The agent processes data from the debugged application, such as variable values and return results, which could theoretically contain malicious instructions.
- Ingestion points: Variable values and expression results are returned to the agent context via the
get_variables_valuesandevaluate_expressiontools. - Boundary markers: The skill emphasizes a systematic "why?" framework for analysis, which encourages objective evaluation of data rather than direct obedience to its content.
- Capability inventory: The skill enables full control over the debugging lifecycle, including breakpoint management and process execution control.
- Sanitization: The procedural guidance notes that the underlying MCP server automatically redacts potential secrets (like API keys) from variable values to prevent accidental exposure.
- External Debugger Requirements: The reference documentation provides instructions for installing necessary development tools, such as the Delve debugger for Go (
go install github.com/go-delve/delve/cmd/dlv@latest). These are standard environment setup steps for the referenced programming languages. - Credential Handling Guidance: The instructions explicitly warn the agent about the risk of process state containing sensitive tokens and environment variables, advising reliance on the server's redaction mechanisms.
Audit Metadata