webgl-debug

Pass

Audited by Gen Agent Trust Hub on Nov 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard shell commands to manage the development environment, specifically using curl to check for an active server on localhost:5173 and pnpm to start the debug-viewer package. These are standard operations for the intended development workflow.- [INDIRECT_PROMPT_INJECTION]: The tool is designed to read and process external data from a browser's console output. This functionality introduces a surface for indirect prompt injection if the web content being debugged contains malicious instructions intended for the AI agent.
  • Ingestion points: Browser console messages retrieved via browser_console_messages as described in REFERENCE.md.
  • Boundary markers: None present in the instructions.
  • Capability inventory: Command execution via Bash and browser automation via Playwright as specified in SKILL.md.
  • Sanitization: The skill does not implement specific sanitization for the console data it processes.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 12, 2026, 08:52 PM