windbg-kernel-irp-lifecycle-triage
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- Standard Diagnostic Commands: The skill instructs the agent to use established WinDbg commands such as
!irpand!irpfind. These are standard tools for kernel debugging and are used within their intended scope for authorized diagnostic sessions. - Verified Documentation Links: All external references point to official Microsoft documentation (
learn.microsoft.com). These are authoritative sources for technical guidance on Windows driver development and debugging. - Secure Feedback Protocol: The skill establishes a process for reporting issues to a vendor-managed repository (
microsoft/WinDbg-Feedback). Importantly, the instructions include a warning to sanitize feedback and avoid uploading sensitive kernel dump content, reflecting a commitment to data privacy. - Indirect Prompt Injection Surface: As a diagnostic tool, the skill processes output from external debugging commands. While the instructions themselves are safe, the consumption of external data is a standard consideration for potential indirect prompt injection if the source data (e.g., a manipulated kernel dump) is untrusted.
Audit Metadata