d3k
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- External Package Execution: The skill's runtime script is designed to download and execute the 'd3k-runtime' package using 'pnpm dlx'. This is a standard mechanism used by the vendor to ensure the latest version of the debugging tools is available without a global installation.
- Privilege Escalation Consideration: The 'portless' configuration component may require one-time administrator authorization. This is used to set up local HTTPS routing and system-level networking features necessary for the browser to interact with the project's development environment.
- Indirect Prompt Injection Surface: Because the skill is designed to monitor and report on browser events, server logs, and network traffic from the web application being tested, it processes untrusted data. The skill documentation notes that redaction is applied to credentials and headers to mitigate risk when displaying this data to the agent.
- Command Execution: The skill utilizes shell commands and process spawning to manage background development servers, browser automation via CDP, and Git operations. These are core to its function as a debugging and testing suite.
Audit Metadata