Debug Probe

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:55 AM UTC
• Version: 1.0.0

Overview

This debugging skill is coherent, but it needs review because it tells agents to add deployable diagnostic logging and expose/export logs without enough safeguards for sensitive data.

Install only if you are comfortable with a debugging workflow that temporarily changes code and collects runtime logs. Use local or non-production repros where possible, avoid logging secrets, tokens, cookies, full payloads, or personal data, do not expose diagnostic dump endpoints without strong access controls, remove instrumentation after debugging, and prefer a reviewed local/project-level install over the unpinned global npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:37

Finding

Unpinned Package Execution in Global Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md:37
Vulnerability Type: Supply-chain risk caused by unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx skills add YOUR_USERNAME/debug-probe -g -y

Technical Analysis

The documented installation command invokes the skills package through npx without specifying an audited version or integrity constraint. Consequently, the package version and executable code resolved from the npm registry may change between installations without any corresponding change to this repository.

The -y option suppresses interactive confirmation, while -g directs the invoked installer to install the Skill globally. The repository identifier also contains the unresolved YOUR_USERNAME placeholder rather than a verified owner and immutable revision. These properties prevent users from reliably determining which package code and Skill revision will execute or be installed when following the instructions.

This is an insecure dependency and installation pattern rather than evidence that the current repository itself contains a malicious payload.

Attack Path

1. An attacker compromises the npm package, publishing account, package resolution path, or repository referenced by the installation command.
2. The attacker publishes a malicious or altered version under the package or repository identity expected by the command.
3. A user follows the README and executes the unpinned npx command.
4. npx resolves and executes the current package code from the registry rather than a previously audited immutable version.
5. The malicious CLI code runs with the privileges of the invoking user.
6. The installer can modify user-accessible files or install attacker-controlled Skill instructions into the global Agent configuration, affecting later Agent sessions.

Impact Assessment

Successful exploitation could provide arbitrary ...[truncated 538 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to a specifically audited version, for example skills@<verified-version>.
2. Replace YOUR_USERNAME with the verified repository owner and reference an immutable commit hash or signed release rather than a mutable branch or tag.
3. Remove -y so users can inspect and confirm the package and installation target before execution.
4. Publish the expected package name, version, repository URL, commit identifier, and integrity checksum in the installation documentation.
5. Prefer installation from a locally reviewed checkout when possible, such as copying the audited Skill files into the project-level Skill directory.
6. Avoid recommending global installation unless cross-project availability is explicitly required; project-level installation reduces the scope of compromised instructions.
7. Document that users should not execute the installer with administrative or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to insert runtime log points and export buffered logs but does not warn against capturing secrets, tokens, personal data, or production-sensitive values. In debugging contexts, logs often intersect with authentication state, request payloads, and environment-specific configuration, so missing guardrails materially raises the risk of sensitive-data exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The automatic trigger conditions are broad enough to activate on many ordinary debugging prompts, increasing the chance the agent will apply runtime instrumentation in contexts where the user did not explicitly request code modification or log collection. In a debugging skill, this expands the operational footprint and can lead to unnecessary code changes or data collection, especially when combined with later instructions to export logs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger list is unusually broad for a debugging skill and includes common terms like 'debug', 'bug', 'broken', 'not working', and 'investigate'. This can cause accidental or overly frequent activation in unrelated contexts, increasing the chance the agent applies invasive debugging guidance when not appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to add instrumentation, build and deploy, then export collected logs, but it provides no safeguards about redacting secrets, limiting logged fields, or avoiding production exposure. Diagnostic logging commonly captures tokens, PII, request payloads, and internal state, so following this guidance can leak sensitive data or create temporary exposure in deployed environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to expose Dump() / Clear() via an HTTP endpoint recommends a remote access path to buffered diagnostic data without any mention of authentication, authorization, transport protection, or environment scoping. If implemented naively, an attacker or unauthorized user could retrieve in-memory diagnostic logs that may contain sensitive operational or user information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples explicitly log values like userId and tokenExp and present a reusable diagnostic buffer without any warning to avoid secrets, personal data, or authentication material. In practice, developers often copy such templates verbatim, so this guidance can lead to sensitive data being retained in memory, printed to consoles, and later exposed through dumps or support artifacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.