openclaw-node-inspect-debugger

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions involve executing shell commands such as node inspect, kill -SIGUSR1, and curl to interact with the Node.js debugger and inspector API. These are standard operations for developers debugging local processes.\n- [EXTERNAL_DOWNLOADS]: The skill suggests downloading the chrome-remote-interface package from the NPM registry to facilitate programmatic debugging. This is a well-known library used for its intended purpose.\n- [DYNAMIC_EXECUTION]: The provided scripts utilize the chrome-remote-interface library to evaluate expressions within the context of a debugged process via the Debugger.evaluateOnCallFrame method.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from a debugged process, such as stack traces and variable values, which represents a potential attack surface for indirect prompt injection.\n
  • Ingestion points: Output from node inspect and event data from the Chrome DevTools Protocol, such as callFrames in references/upstream/SKILL.source.md.\n
  • Boundary markers: None identified; the agent is instructed to process the inspector's output directly.\n
  • Capability inventory: The skill uses node, npm, and kill capabilities through the shell.\n
  • Sanitization: No explicit sanitization of the debugged process's state is performed before the information is analyzed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 05:49 PM