skills/microsoft/debugmcp/debug-live/Gen Agent Trust Hub

debug-live

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • Dynamic Execution via Debugger Tools: The skill instructs the agent to use tools like evaluate_expression to run code within a live debug session. While this involves dynamic execution, it is the intended purpose of the skill to allow the agent to test hypotheses and inspect runtime state during debugging.
  • Indirect Prompt Injection Surface: The agent processes data from the debugged application, such as variable values and return results, which could theoretically contain malicious instructions.
  • Ingestion points: Variable values and expression results are returned to the agent context via the get_variables_values and evaluate_expression tools.
  • Boundary markers: The skill emphasizes a systematic "why?" framework for analysis, which encourages objective evaluation of data rather than direct obedience to its content.
  • Capability inventory: The skill enables full control over the debugging lifecycle, including breakpoint management and process execution control.
  • Sanitization: The procedural guidance notes that the underlying MCP server automatically redacts potential secrets (like API keys) from variable values to prevent accidental exposure.
  • External Debugger Requirements: The reference documentation provides instructions for installing necessary development tools, such as the Delve debugger for Go (go install github.com/go-delve/delve/cmd/dlv@latest). These are standard environment setup steps for the referenced programming languages.
  • Credential Handling Guidance: The instructions explicitly warn the agent about the risk of process state containing sensitive tokens and environment variables, advising reliance on the server's redaction mechanisms.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 07:22 PM