Skip to content
Report library
Purpose / Other

Reproduce Bug Report Skill Security Audit

What the author says it does (original text)

Launch Oz cloud agents with computer use to reproduce UI-focused bug reports, capture visual evidence (a screen recording by default), and report reproduction findings. Use when investigating a specific interactive or visual bug from an issue, ticket, support report, or prompt.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Default screen recording may capture sensitive content and auto-post it when Slack thread context is present

Source references: 5
What we found

Agents are told to record the full reproduction by default. If Slack channel and thread context is merely provided, the instructions require posting the recording there without obtaining a separate explicit publishing approval. Although another rule prohibits private details, recording happens before review or redaction, so transient dialogs, notifications, account data, and internal URLs may still enter the video.

Why this matters

The recording could expose customer data, internal interfaces, notifications, or session information to channel members who should not see it. Once uploaded, it may also be retained, downloaded, or forwarded under Slack policies.

The skill records the reproduction by default and directs the agent to post the recording when a Slack channel and thread are present; that condition does not also require a separate explicit posting authorization. The express prohibition on private details reduces the risk, but recordings can still inadvertently capture notifications, account information, or private URLs before being uploaded. This risk applies only when Slack thread context is supplied and posting is available. Users can require human review/redaction before upload and keep thread identification separate from authorization to post.

SKILL.md:70In the instructionsOpen original file
- Reproduce the reported behavior as faithfully as possible.- Capture a screen recording of the reproduction by default; most UI bugs involve motion, a transition, or a multi-step interaction, so a clip is stronger proof than stills. Capture screenshots as a supplement, or as the primary artifact only for a genuinely static render.- If the provided steps are unclear or incomplete, use codebase and product knowledge to identify plausible app states that could produce the reported behavior, then test the assigned hypothesis.
Show 4 other places
SKILL.md:82In the instructionsOpen original file
- Do not ask the public reporter for credentials, tokens, private repos, private workspace names, or private account identifiers.- Do not include secrets, auth tokens, private URLs, Authorization headers, refresh tokens, or other private account details in recordings, screenshots, logs, manifests, or final reports.- Do not create or sign into an account unless the prompt and repository-specific guidance explicitly authorize a safe test-auth workflow.- If the assigned report cannot be exercised within the allowed auth/state constraints, stop and report the blocker.- Do not post comments to GitHub, Linear, or external services unless explicitly instructed. When a Slack thread context is provided (a channel id and thread), post the reproduction proof (the recording) back to that thread so the requester sees it; do not post to any other channel or service.- Avoid destructive actions. If a repro requires deleting app state, delete only test state for the current repro environment and report exactly what was reset.
SKILL.md:90In the instructionsOpen original file
- Create a dedicated artifact directory named for your variant, such as `~/bug-repro-primary`.- Record a screen recording of the reproduction by default and save it in the artifact directory with a descriptive name such as `repro.mp4`.- Capture screenshots as a supplement (or as the primary artifact only for a genuinely static render) with ordered filenames, such as `01-initial-state.png`, `02-before-click-settings.png`, and `03-after-click-settings.png`.
SKILL.md:98In the instructionsOpen original file
  - whether the screenshot shows the reported bug- If the harness supports built-in screenshot or artifact upload, use it. Otherwise leave artifacts in the directory and report the paths.
SKILL.md:85In the instructionsOpen original file
- If the assigned report cannot be exercised within the allowed auth/state constraints, stop and report the blocker.- Do not post comments to GitHub, Linear, or external services unless explicitly instructed. When a Slack thread context is provided (a channel id and thread), post the reproduction proof (the recording) back to that thread so the requester sees it; do not post to any other channel or service.- Avoid destructive actions. If a repro requires deleting app state, delete only test state for the current repro environment and report exactly what was reset.
Medium risk

Bug-report content is sent to Oz cloud agents

Source references: 5
What we found

The Skill directs the parent to paste or summarize issue bodies, comments, screenshot or video descriptions, labels, and metadata into child prompts processed by Oz cloud agents with computer-use access. Its token safeguards do not require filtering other confidential business information, customer data, or private code details before transmission.

Why this matters

Customer names, internal URLs, unreleased features, workspace details, or screenshot content from private tickets may be processed by a third-party cloud agent and may enter agent-run records or artifacts.

This is an active workflow, not an example: it directs the parent to launch computer-enabled Oz cloud agents and place issue text, comments, screenshot/video descriptions, and metadata in their input. A report could therefore leave the current environment with customer data, internal business information, or private code details not expressly covered by the prohibited-data list. The safety rules prohibit requesting credentials and require stopping on disallowed authentication state, but do not clearly require minimization or full redaction before upload. Users can require documented Oz retention/access terms and permit only a reviewed, minimal summary.

SKILL.md:10In the instructionsOpen original file
The parent agent should not try to manually reproduce the UI bug locally unless the user explicitly asks. Launch one or more Oz cloud agents with computer use enabled so they can run the relevant app, interact with it, and capture visual evidence.
Show 4 other places
SKILL.md:74In the instructionsOpen original file
Inputs:- Bug report context: <paste or summarize the issue body, comments, screenshots/video descriptions, labels, and relevant metadata>- Assigned repro path or hypothesis: <specific steps, environment, app state, settings, feature flags, or code path to test>- Reporter app version/build/channel: <exact value from the report, or unknown>- Build/app target: <exact runnable artifact to install, or the justified fallback if exact artifact is unavailable>
SKILL.md:81In the instructionsOpen original file
Safety and privacy:- Do not ask the public reporter for credentials, tokens, private repos, private workspace names, or private account identifiers.- Do not include secrets, auth tokens, private URLs, Authorization headers, refresh tokens, or other private account details in recordings, screenshots, logs, manifests, or final reports.- Do not create or sign into an account unless the prompt and repository-specific guidance explicitly authorize a safe test-auth workflow.
SKILL.md:75In the instructionsOpen original file
Inputs:- Bug report context: <paste or summarize the issue body, comments, screenshots/video descriptions, labels, and relevant metadata>- Assigned repro path or hypothesis: <specific steps, environment, app state, settings, feature flags, or code path to test>
SKILL.md:84In the instructionsOpen original file
- Do not create or sign into an account unless the prompt and repository-specific guidance explicitly authorize a safe test-auth workflow.- If the assigned report cannot be exercised within the allowed auth/state constraints, stop and report the blocker.- Do not post comments to GitHub, Linear, or external services unless explicitly instructed. When a Slack thread context is provided (a channel id and thread), post the reproduction proof (the recording) back to that thread so the requester sees it; do not post to any other channel or service.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

A repository-supplied companion Skill can inject additional reproduction instructions

Source references: 2
What we found

The Skill requires reading and applying `reproduce-bug-report-local` from the consuming repository, allowing repository content to influence app setup, environment, and workflow. It says the companion should not redefine safety rules, but does not require provenance checks, an allowed-field schema, or rejection of conflicting instructions.

Why this matters

A malicious or compromised repository could use the companion Skill to induce extra installation steps, access unnecessary data, widen the recording scope, or transmit artifacts to external services.

This is an operative delegation instruction: when the repository companion exists or is referenced, the agent must read and apply it, allowing repository content to alter scope, application setup, environment, and workflow. The core text says the companion “should not” redefine safety and evidence expectations, but shows no conflict check or source verification. If the consuming repository is untrusted or compromised, the companion could induce additional installation, access, or data handling. Users can restrict use to reviewed, pinned companion skills and require the agent to stop on conflicts with core safety rules.

SKILL.md:42In the instructionsOpen original file
## Repository-specific guidanceThe consuming repository may ship a companion `reproduce-bug-report-local` skill. When that companion is available or referenced in the prompt, read it and apply its repository-specific scope, app setup, environment, and workflow guidance as supplemental instructions. The local companion may narrow scope or specialize setup, but it should not redefine the evidence, artifact, reporting, or safety expectations in this core skill.
Show 1 other places
SKILL.md:44In the instructionsOpen original file
The consuming repository may ship a companion `reproduce-bug-report-local` skill. When that companion is available or referenced in the prompt, read it and apply its repository-specific scope, app setup, environment, and workflow guidance as supplemental instructions. The local companion may narrow scope or specialize setup, but it should not redefine the evidence, artifact, reporting, or safety expectations in this core skill.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

7 instruction sections

The Skill delegates UI-bug reproduction to Oz cloud agents with computer-use access. When several hypotheses exist, it can launch multiple agents to operate the app and collect visual evidence.

View source
SKILL.md:10In the instructionsOpen original file
The parent agent should not try to manually reproduce the UI bug locally unless the user explicitly asks. Launch one or more Oz cloud agents with computer use enabled so they can run the relevant app, interact with it, and capture visual evidence.
SKILL.md:24In the instructionsOpen original file
   - If the report requires credentials, private account state, or another capability not available to the repro environment, report that constraint clearly instead of guessing.3. If the reproduction path is straightforward, launch one Oz cloud agent with computer use.4. If there are multiple plausible repro paths, launch several Oz cloud agents in one `run_agents` batch. Give each child a distinct hypothesis or environment variant, such as:   - different OS or desktop environment

Each reproduction records the screen by default and may upload recordings, screenshots, and a manifest. Agents also collect environment, version, log, and code-path details.

View source
SKILL.md:90In the instructionsOpen original file
- Create a dedicated artifact directory named for your variant, such as `~/bug-repro-primary`.- Record a screen recording of the reproduction by default and save it in the artifact directory with a descriptive name such as `repro.mp4`.- Capture screenshots as a supplement (or as the primary artifact only for a genuinely static render) with ordered filenames, such as `01-initial-state.png`, `02-before-click-settings.png`, and `03-after-click-settings.png`.- Maintain a short manifest in the artifact directory with:  - recording or screenshot filename  - timestamp  - visible app state  - action just taken or about to be taken  - whether the screenshot shows the reported bug- If the harness supports built-in screenshot or artifact upload, use it. Otherwise leave artifacts in the directory and report the paths.
SKILL.md:123In the instructionsOpen original file
- The exact steps you performed.- Environment and app/build information.- Reporter-requested app version/build/channel, installed test version/build/channel, and the artifact source or fallback explanation.- Whether the observed behavior matched the report, and how closely.- The screen recording (and any supplementary screenshots) with short descriptions and artifact paths or attachment names.- Any logs, crash output, or diagnostics collected, with secrets redacted.- The most likely code path or state involved, if investigated.- Suggested next debugging step or follow-up question, only if it would materially change the next action.

The Skill includes explicit safeguards: credentials and tokens must not be requested or recorded, account sign-in requires explicit authorization, and any state deletion must be confined to test state in the current reproduction environment.

View source
SKILL.md:81In the instructionsOpen original file
Safety and privacy:- Do not ask the public reporter for credentials, tokens, private repos, private workspace names, or private account identifiers.- Do not include secrets, auth tokens, private URLs, Authorization headers, refresh tokens, or other private account details in recordings, screenshots, logs, manifests, or final reports.- Do not create or sign into an account unless the prompt and repository-specific guidance explicitly authorize a safe test-auth workflow.- If the assigned report cannot be exercised within the allowed auth/state constraints, stop and report the blocker.- Do not post comments to GitHub, Linear, or external services unless explicitly instructed. When a Slack thread context is provided (a channel id and thread), post the reproduction proof (the recording) back to that thread so the requester sees it; do not post to any other channel or service.- Avoid destructive actions. If a repro requires deleting app state, delete only test state for the current repro environment and report exactly what was reset.
Start here · InstructionsSKILL.md
reproduce-bug-report
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Read keys or account settings
SKILL.md:23In the instructionsOpen original file
   - Do not use it for purely backend, CI, build, dependency, or text-only code issues unless the prompt specifically asks for visual reproduction.   - If the report requires credentials, private account state, or another capability not available to the repro environment, report that constraint clearly instead of guessing.3. If the reproduction path is straightforward, launch one Oz cloud agent with computer use.
SKILL.md:81In the instructionsOpen original file
Safety and privacy:- Do not ask the public reporter for credentials, tokens, private repos, private workspace names, or private account identifiers.- Do not include secrets, auth tokens, private URLs, Authorization headers, refresh tokens, or other private account details in recordings, screenshots, logs, manifests, or final reports.
SKILL.md:172In the instructionsOpen original file
- Enough environment detail for an engineer to repeat the test.- No leaked secrets, credentials, private account details, or unnecessary public comments.
Lines read
198
File checksum (to compare versions)
f7b91f4b49114bd0a40030d5740f162c37594bd5ce5745129c3cc6a098c0e076