Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only debugging skill whose introspection examples are purpose-aligned, though users should avoid dumping sensitive variables to logs.
Install only if you want Nasal/FlightGear debugging reference material. When following the examples, avoid dumping full local scopes or backtraces in production, shared logs, or sessions that may contain passwords, tokens, or private data.
The documentation explicitly shows debug.dump() dumping the entire local namespace when called without arguments, but it does not warn that this can expose secrets, credentials, tokens, or internal state to logs. In an agent or plugin environment, console output may be collected centrally or exposed to operators, turning routine debugging into unintended data disclosure.
The debug.backtrace() documentation states that it prints all active local namespace variables for every stack frame, but it provides no warning about the sensitivity of those values. Backtraces with locals can leak API keys, passwords, session data, or private business logic into logs, especially when triggered during exception handling or incident response.
No suspicious patterns detected.
