Skip to content
skillsafebeta
← Report library
Purpose / Development

Diagnosing Bugs Skill Security Audit

What the author says it does (original text)

Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.

Independent security check

Security risks found

Files checked
3
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Parallel stress and high-count loops can overload shared or production systems

Source references: 3
What we found

For nondeterministic bugs, the Skill directs the agent to loop a trigger 100 times, parallelize it, and add stress, without restricting those actions to local or isolated environments or setting concurrency and request limits.

Why this matters

If the reproduction targets a shared, metered, or production service, testing could consume quotas, increase costs, disrupt other users, or trigger rate limits and security alerts.

The active instruction for intermittent failures explicitly calls for 100 trigger iterations, parallel execution, and added stress, but does not confine that activity to a local or isolated system or set concurrency, request, or cost limits. If the reproduction command targets a shared, metered, or production service, it could increase load, charges, alerts, or data side effects. Users can ask that stress reproduction default to local test environments and require confirmation of the target, rate, and budget before using any remote system.

SKILL.md:51In the instructionsOpen original file
The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not, so keep raising the rate until it's debuggable.
Show 2 other places
SKILL.md:49In the instructionsOpen original file
### Non-deterministic bugsThe goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not, so keep raising the rate until it's debuggable.
SKILL.md:27In the instructionsOpen original file
1. **Failing test** at whatever seam reaches the bug: unit, integration, e2e.2. **Curl / HTTP script** against a running dev server.3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.4. **Headless browser script** (Playwright / Puppeteer) that drives the UI and asserts on DOM/console/network.5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Captured network artifacts and error text may retain credentials or sensitive data

Source references: 5
What we found

The workflow permits saving real network requests, payloads, or event logs to disk and acknowledges that captured artifacts contain authentication headers. Its redaction instruction governs what is shown or quoted, but does not require removing those headers before storage. The template also echoes pasted error text verbatim.

Why this matters

Tokens, cookies, personal data, or internal addresses in requests, HAR files, logs, or errors could remain in the workspace or terminal history and become visible to later tools, log collectors, or other parties with file access.

The workflow permits saving real requests, payloads, or event logs and acknowledges that captured artifacts can contain authentication headers. It requires redaction before showing or quoting them and leaves sign-in to the user, but does not require redaction before disk storage or define storage permissions, location, or retention. Raw captures could therefore expose session credentials on disk. The template also echoes pasted error text unchanged. Users can ask for pre-storage redaction, a restricted temporary directory, automatic cleanup, and guidance not to paste tokens or personal data.

SKILL.md:14In the instructionsOpen original file
This skill has you show commands, outputs and captured artifacts. **Redact every secret first**: write `<REDACTED>` in its place. Build loops against env vars, so the credential stays in the environment rather than in what you show. Captured artifacts carry auth headers: quote only the lines that carry the signal.
Show 4 other places
SKILL.md:30In the instructionsOpen original file
4. **Headless browser script** (Playwright / Puppeteer) that drives the UI and asserts on DOM/console/network.5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
scripts/hitl-loop.template.sh:38In the codeOpen original file
capture ERROR_MSG "Paste the error message (or 'none'):"# --- edit above ---------------------------------------------------------printf '\n--- Captured ---\n'printf 'ERRORED=%s\n' "$ERRORED"printf 'ERROR_MSG=%s\n' "$ERROR_MSG"
scripts/hitl-loop.template.sh:44In the codeOpen original file
printf 'ERRORED=%s\n' "$ERRORED"printf 'ERROR_MSG=%s\n' "$ERROR_MSG"
scripts/hitl-loop.template.sh:15In the codeOpen original file
## `capture` prints its value back to the terminal, where the agent reads it,# so capture observations, and leave signing in to the user as a `step`.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The workflow directs code changes even when the user requested diagnosis only

Source references: 4
What we found

The declared purpose is diagnosis, but mandatory phases include writing a regression test, applying a fix, and deleting prototypes. It does not require user approval before moving from diagnosis into modification.

Why this matters

For a root-cause-only request, the agent could still alter product code, tests, or debugging files. Those changes could disturb existing work, change behavior, or remove diagnostic material the user intended to retain.

The stated trigger is diagnosis or debugging, but the later workflow directs the agent to write a test and “apply the fix” when a suitable test seam exists, without separately checking whether the user authorized more than read-only diagnosis. If the user only requested a cause analysis, this could alter code and tests; cleanup also calls for deleting throwaway prototypes. Users can explicitly restrict use to read-only diagnosis and require separate approval before any code change or file deletion.

SKILL.md:2In the instructionsOpen original file
---name: diagnosing-bugsdescription: Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.---
Show 3 other places
SKILL.md:114In the instructionsOpen original file
## Phase 5: Fix + regression testWrite the regression test **before the fix**, but only if there is a **correct seam** for it.
SKILL.md:124In the instructionsOpen original file
1. Turn the minimised repro into a failing test at that seam.2. Watch it fail.3. Apply the fix.4. Watch it pass.5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.
SKILL.md:137In the instructionsOpen original file
- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)- [ ] The hypothesis that turned out correct is stated in the commit / PR message, so the next debugger learns
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

7 instruction sections

The Skill requires first building a repeatable feedback loop that detects the user's exact symptom, then minimizing the reproduction, testing multiple falsifiable hypotheses with targeted probes, and validating the result against the original scenario.

View source
SKILL.md:59In the instructionsOpen original file
Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** (a script path, a test invocation, a curl) that you have **already run at least once** (show the invocation and its output, redacted), and that is:- [ ] **Red-capable**: it drives the actual bug code path and asserts the **user's exact symptom**, so it can go red on this bug and green once fixed. Not "runs without erroring"; it must be able to _catch this specific bug_.- [ ] **Deterministic**: same verdict every run (flaky bugs: a pinned, high reproduction rate, per above).- [ ] **Fast**: seconds, not minutes.- [ ] **Agent-runnable**: you can run it unattended; a human in the loop only via `scripts/hitl-loop.template.sh`.
SKILL.md:90In the instructionsOpen original file
Generate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.Each hypothesis must be **falsifiable**: state the prediction it makes.
SKILL.md:124In the instructionsOpen original file
1. Turn the minimised repro into a failing test at that seam.2. Watch it fail.3. Apply the fix.4. Watch it pass.5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.

The Skill explicitly requires secrets to be replaced before commands, outputs, or captured artifacts are shown, recommends keeping credentials in environment variables, and says to ask the user if redacted information is insufficient.

View source
SKILL.md:14In the instructionsOpen original file
This skill has you show commands, outputs and captured artifacts. **Redact every secret first**: write `<REDACTED>` in its place. Build loops against env vars, so the credential stays in the environment rather than in what you show. Captured artifacts carry auth headers: quote only the lines that carry the signal.If the redacted output is not enough to diagnose the bug, say so and ask the user.

The included human-in-the-loop template asks the user to perform sign-in and click actions, then prints the user's error-message input verbatim to the terminal for the agent to read.

View source
scripts/hitl-loop.template.sh:34In the codeOpen original file
step "Open the app at http://localhost:3000 and sign in."capture ERRORED "Click the 'Export' button. Did it throw an error? (y/n)"capture ERROR_MSG "Paste the error message (or 'none'):"
scripts/hitl-loop.template.sh:42In the codeOpen original file
printf '\n--- Captured ---\n'printf 'ERRORED=%s\n' "$ERRORED"printf 'ERROR_MSG=%s\n' "$ERROR_MSG"
Start here · InstructionsSKILL.md
diagnosing-bugs
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • scripts/hitl-loop.template.shFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
  • scripts/hitl-loop.template.shScript

Operations mentioned in code and instructions

Connect to websites
scripts/hitl-loop.template.sh:34In the codeOpen original file
step "Open the app at http://localhost:3000 and sign in."
SKILL.md:27In the instructionsOpen original file
1. **Failing test** at whatever seam reaches the bug: unit, integration, e2e.2. **Curl / HTTP script** against a running dev server.3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.
SKILL.md:59In the instructionsOpen original file
Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** (a script path, a test invocation, a curl) that you have **already run at least once** (show the invocation and its output, redacted), and that is:
Run commands
scripts/hitl-loop.template.sh:1In the codeOpen original file
#!/usr/bin/env bash# Human-in-the-loop reproduction loop.
scripts/hitl-loop.template.sh:7In the codeOpen original file
# Usage:#   bash hitl-loop.template.sh#
SKILL.md:35In the instructionsOpen original file
9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.
Lines read
188
File checksum (to compare versions)
8be72a06260e95fe7b5213272703b7d5674782ad710e23a56476e63ed4217c76