vvvv-debugging
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates for executing development commands such as
dotnet buildandMSBuild.exethrough generated VS Code task configurations. It also utilizes a shell command (ls) to automatically detect the installation directory of vvvv gamma on the user's system. - [INDIRECT_PROMPT_INJECTION]: The skill scans the local workspace for project-specific files like
.csproj,.sln, and.vlto extract package names and project structures. This ingestion of local file data represents an attack surface where a malicious project could influence the agent's behavior. - Ingestion points: Automatic workspace scanning for project files and metadata in SKILL.md.
- Boundary markers: There are no explicit delimiters for the ingested data, but the skill mandates the use of
AskUserQuestionto verify all parameters with the user before generating any configuration. - Capability inventory: The skill has the ability to write configuration files to the workspace and execute shell-based build commands.
- Sanitization: The skill relies on human-in-the-loop review through confirmation prompts rather than automated data sanitization.
Audit Metadata