debugging-ui-flows
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill outlines a diagnostic process for instrumenting code with temporary logging to identify UI bugs. It emphasizes a 'minimal path' approach and the eventual removal of all added code.
- [DATA_EXPOSURE]: The instructions include a 'Log Contract' that explicitly forbids logging secrets, tokens, passwords, raw auth headers, and personally identifiable information (PII). It also requires the agent to verify that all temporary debug logs and files are deleted before the task is considered complete.
- [INDIRECT_PROMPT_INJECTION]: The skill involves the agent processing external data (logs and reproduction trails) provided by the human user.
- Ingestion points: The agent is instructed to read 'sinks' such as server terminal output, browser console pastes, and network status details provided by the user (Step 4).
- Boundary markers: The skill suggests using a specific
debugRunIdandDEBUG_FLOWprefix to filter relevant logs, though these act as identifiers rather than security boundaries. - Capability inventory: The agent is expected to perform file writes (adding instrumentation) and reads (evaluating logs) within the project environment.
- Sanitization: There are no specific instructions for sanitizing the content of the logs before the agent processes them, relying on the user to provide the relevant snippets.
Audit Metadata