vvvv-debugging

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides templates for executing development commands such as dotnet build and MSBuild.exe through generated VS Code task configurations. It also utilizes a shell command (ls) to automatically detect the installation directory of vvvv gamma on the user's system.
  • [INDIRECT_PROMPT_INJECTION]: The skill scans the local workspace for project-specific files like .csproj, .sln, and .vl to extract package names and project structures. This ingestion of local file data represents an attack surface where a malicious project could influence the agent's behavior.
  • Ingestion points: Automatic workspace scanning for project files and metadata in SKILL.md.
  • Boundary markers: There are no explicit delimiters for the ingested data, but the skill mandates the use of AskUserQuestion to verify all parameters with the user before generating any configuration.
  • Capability inventory: The skill has the ability to write configuration files to the workspace and execute shell-based build commands.
  • Sanitization: The skill relies on human-in-the-loop review through confirmation prompts rather than automated data sanitization.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 08:43 AM