debugging-code
Warn
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill initiates downloads of the 'dap' binary and various debug adapters from external sources.\n
- Evidence: Downloads from
github.com/AlmogBaku/debug-skillviascripts/install-dap.shandmicrosoft/vscode-js-debugviareferences/installing-debuggers.md.\n- [REMOTE_CODE_EXECUTION]: The installation process fetches pre-compiled binaries from a community GitHub repository and executes them on the host system.\n - Evidence: The script
scripts/install-dap.shusescurlto download a binary to~/.local/binor/usr/local/binand applieschmod +x.\n- [COMMAND_EXECUTION]: The skill uses shell commands to interact with debuggers and manage process execution.\n - Evidence: Uses
dap debug,dap step,dap continue, and allows attaching to processes via PID or host:port.\n- [PERSISTENCE]: The installation script suggests modifications to the user's shell profile to ensure the tool remains in the system PATH.\n - Evidence: Recommends adding export statements to
~/.bashrc,~/.zshrc, or~/.config/fish/config.fish.\n- [DYNAMIC_EXECUTION]: The skill allows for the evaluation of arbitrary expressions against a running program's state.\n - Evidence: The
dap eval "<expr>"command facilitates runtime execution of code within the context of the debugged process.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingest and displays output from external programs and evaluated expressions which could contain malicious instructions.\n - Ingestion points: Program output (
dap output), variable inspection (dap inspect), and expression evaluation (dap eval) inSKILL.md.\n - Boundary markers: The skill uses structural headers like 'Locals:', 'Stack:', and 'Output:' to delimit data.\n
- Capability inventory: Includes shell command execution, process attachment, and file system modification via installation scripts.\n
- Sanitization: No explicit sanitization of debugged program output or evaluation results is documented.
Audit Metadata