{"data":{"skill":{"slug":"wshobson-debugging-strategies","name":"debugging-strategies","icon":"📦","repo":"https://github.com/wshobson/agents/tree/main/plugins/developer-essentials/skills/debugging-strategies","status":"approved","author":"wshobson","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"e892dbba-ce4f-47fd-b5b4-cec9d2c1a4d8","skill_id":"3134ad8d-6f13-4c16-bd5b-1084ccd56a1c","version":6,"content_hash":"289469fd6dd0cf5f25091fcb8568b76c","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported dynamic imports, shell backticks, weak crypto, reconnaissance, and a URL, but context shows documentation examples. No executable files or prompt injection were found; low risk remains because the skill teaches command-line debugging workflows.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":274,"line_start":270},{"file":"SKILL.md","line_end":301,"line_start":298}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":70,"line_start":53},{"file":"SKILL.md","line_end":74,"line_start":70},{"file":"SKILL.md","line_end":97,"line_start":74},{"file":"SKILL.md","line_end":101,"line_start":97},{"file":"SKILL.md","line_end":121,"line_start":101},{"file":"SKILL.md","line_end":125,"line_start":121},{"file":"SKILL.md","line_end":147,"line_start":125},{"file":"SKILL.md","line_end":153,"line_start":147},{"file":"SKILL.md","line_end":182,"line_start":153},{"file":"SKILL.md","line_end":185,"line_start":182},{"file":"SKILL.md","line_end":209,"line_start":185},{"file":"SKILL.md","line_end":213,"line_start":209},{"file":"SKILL.md","line_end":261,"line_start":213},{"file":"SKILL.md","line_end":265,"line_start":261},{"file":"SKILL.md","line_end":307,"line_start":265},{"file":"SKILL.md","line_end":313,"line_start":307},{"file":"SKILL.md","line_end":326,"line_start":313},{"file":"SKILL.md","line_end":332,"line_start":326},{"file":"SKILL.md","line_end":345,"line_start":332},{"file":"SKILL.md","line_end":349,"line_start":345},{"file":"SKILL.md","line_end":355,"line_start":349},{"file":"SKILL.md","line_end":357,"line_start":355},{"file":"SKILL.md","line_end":370,"line_start":357},{"file":"SKILL.md","line_end":374,"line_start":370},{"file":"SKILL.md","line_end":401,"line_start":374},{"file":"SKILL.md","line_end":404,"line_start":401},{"file":"SKILL.md","line_end":410,"line_start":404},{"file":"SKILL.md","line_end":432,"line_start":410},{"file":"SKILL.md","line_end":436,"line_start":432},{"file":"SKILL.md","line_end":455,"line_start":436},{"file":"SKILL.md","line_end":459,"line_start":455},{"file":"SKILL.md","line_end":478,"line_start":459},{"file":"SKILL.md","line_end":503,"line_start":478},{"file":"SKILL.md","line_end":518,"line_start":503}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":295,"line_start":295}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Command Examples Require User Judgment","locations":[{"file":"SKILL.md","line_end":326,"line_start":313},{"file":"SKILL.md","line_end":478,"line_start":459}],"confidence":0.82,"description":"The skill includes git bisect, debugger, profiling, and production debugging examples. These are legitimate instructions, but users should review commands before running them.","confidence_reasoning":"The cited lines are documentation examples, not executable skill code. The residual risk is user misuse of debugging commands in real environments."},{"title":"Static Analyzer False Positives in Markdown","locations":[{"file":"SKILL.md","line_end":74,"line_start":53},{"file":"SKILL.md","line_end":361,"line_start":349}],"confidence":0.96,"description":"The shell backtick and weak crypto hits are caused by markdown code fences, prose, or ordinary identifiers. No evidence found of actual shell execution or cryptographic code.","confidence_reasoning":"The locations are inside fenced documentation blocks or normal TypeScript examples. There is no runtime wrapper that executes this content."},{"title":"Local Profiling URL Is Benign","locations":[{"file":"SKILL.md","line_end":295,"line_start":293}],"confidence":0.93,"description":"The hardcoded URL points to localhost pprof documentation. No evidence found of external network access, data exfiltration, or remote callback behavior.","confidence_reasoning":"The URL is localhost and appears in a Go profiling example. It does not contact a third-party service or transmit data."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":528,"audit_model":"codex","audited_at":"2026-06-30T22:45:19.592+00:00","created_at":"2026-06-30T23:49:23.088334+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}