Content revision r2 Medium Riskโ๏ธ External commands
Debug Software with Structured Evidence
Intermittent bugs are difficult to isolate when evidence is incomplete. This skill structures hypotheses, captures diagnostic evidence, applies focused fixes, and verifies regressions.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "debugger" from https://skillstore.io/skills/cubha-debugger.md and its manifest at https://skillstore.io/api/skills/cubha-debugger/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.
Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Two of 38 static findings are confirmed because the workflow runs project-controlled verification scripts that may execute arbitrary repository code. The remaining static findings are Markdown, safe examples, or explicit prohibitions. A separate medium-risk finding covers direct source edits and marker-based deletion.
The workflow inserts logs directly into source files, then removes each marker and its following line. A misplaced marker could delete unintended code.
The instructions explicitly require direct log insertion and pair-based deletion. The source mutation is intentional, while the unintended-deletion risk depends on marker integrity.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The workflow explicitly runs verify.sh, package scripts, builds, or tests. Repository-controlled scripts can execute arbitrary code without a stated confirmation step.
The Playwright workflow explicitly runs project verification scripts and package commands. Those repository-controlled commands can execute arbitrary code without a stated confirmation step.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Analyze a stack trace, add focused diagnostics, identify the failing path, and verify the fix.
Reproduce a Browser Defect
Use Playwright evidence to reproduce a web issue and compare behavior before and after a fix.
Repair a Cross-Module Regression
Check callers, data contracts, and shared state before applying a durable correction.
Try These Prompts
Diagnose an Error
Diagnose this error: [paste error]. Identify likely causes, inspect relevant files, and tell me what evidence you need before changing code.
Instrument an Intermittent Failure
Debug this intermittent failure in [feature]. Add temporary marked logs at the strongest hypotheses, then wait for my results before fixing anything.
Debug a Browser Scenario
Use --pw on [URL] to reproduce [scenario]. Capture console, network, screenshot, and DOM evidence, then fix and rerun the scenario.
Investigate a Boundary Regression
Investigate [bug] across [modules]. Check caller, API, data, and shared-state boundaries before applying a durable fix and running all available regression gates.
Best Practices
Provide the exact error, reproduction steps, environment, and recent changes.
Review proposed diagnostic locations before running the affected application.
Inspect every final diff and confirm that temporary logs were removed.
Avoid
Do not use this workflow for feature development or general code review.
Do not run project scripts from an untrusted repository without inspection and confirmation.
Do not include passwords, tokens, personal data, or production records in diagnostic output.
Frequently Asked Questions
Which languages support temporary logging?
The defined formats cover JavaScript, TypeScript, Python, Java, and Kotlin.
Does the skill require Playwright?
No. The default workflow uses user-provided logs. Playwright MCP is required only for --pw browser mode.
Will it change source files?
Yes. It can insert temporary logs, apply a focused fix, and remove its marked diagnostics.
How does it protect sensitive data?
The workflow requires masking passwords, tokens, and personal data. It also forbids logging in environment and secrets files.
How does it verify a fix?
It reruns the failing scenario and available project checks, such as tests, builds, linting, or type checks.
What happens when the cause remains unclear?
It adds limited diagnostic rounds, requests more reproduction details, and stops after the configured retry limit.