diagnosing-bugs
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill outlines a disciplined methodology for bug diagnosis and performance analysis, focusing on building feedback loops and falsifiable hypotheses.\n- [SAFE]: The skill incorporates strong data privacy instructions, requiring the agent to redact secrets and credentials (replacing them with
<REDACTED>) before displaying outputs or artifacts.\n- [COMMAND_EXECUTION]: To verify and reproduce bugs, the skill guides the agent to execute shell commands, run test suites, perform HTTP requests viacurl, and utilize UI automation tools like Playwright or Puppeteer. These actions are appropriate for the skill's stated purpose of debugging.\n- [PROMPT_INJECTION]: The agent is instructed to analyze potentially untrusted data, which presents a surface for indirect prompt injection.\n - Ingestion points: User input via
scripts/hitl-loop.template.sh, captured artifacts such as logs, traces, and HAR files.\n - Boundary markers: The skill uses redaction instructions but does not specify technical delimiters for untrusted content.\n
- Capability inventory: The agent can execute arbitrary shell commands, network operations (curl), and browser automation to test hypotheses.\n
- Sanitization: The skill mandates the redaction of secrets and authentication headers from all processed artifacts.
Audit Metadata