Skills when-debugging-code-use-debugging-assistant

📦

when-debugging-code-use-debugging-assistant

Name: when-debugging-code-use-debugging-assistant
Author: DNYoussef

Content revision r1 High Risk ⚙️ External commands🔑 Env variables📁 Filesystem access

透過根本原因分析偵錯程式碼

當症狀、原因、修復與測試被分開處理時，偵錯可能會停滯。此技能會引導一套五階段工作流程，用於診斷、修復、驗證與預防迴歸。

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Maintain this Skill? Claim it ⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "when-debugging-code-use-debugging-assistant" from https://skillstore.io/skills/dnyoussef-when-debugging-code-use-debugging-assistant.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-debugging-code-use-debugging-assistant/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dnyoussef-when-debugging-code-use-debugging-assistant.md Signed manifest GET /api/skills/dnyoussef-when-debugging-code-use-debugging-assistant/manifest Signed lockfile GET /api/skills/dnyoussef-when-debugging-code-use-debugging-assistant/lockfile

Test it

Using "when-debugging-code-use-debugging-assistant". 使用者在近期部署後看到登入錯誤。

Expected outcome:

症狀摘要列出失敗路徑、觀察到的錯誤、受影響使用者與重現狀態。
根本原因分析聚焦於近期驗證變更與缺少的使用者物件驗證。
驗證計畫包含登入迴歸測試，以及缺少使用者資料的負面案例。

Using "when-debugging-code-use-debugging-assistant". 結帳測試在平行執行期間間歇性失敗。

Expected outcome:

此工作流程會將時序症狀與資料損毀症狀分開。
可能原因被描述為需要隔離的共享狀態或順序問題。
預防步驟包含確定性的迴歸測試，以及給未來審查者的備註。

Using "when-debugging-code-use-debugging-assistant". 新增事件監聽器後出現記憶體洩漏。

Expected outcome:

此報告將監聽器生命週期檢查識別為主要調查路徑。
修復計畫強調清理行為與可衡量的記憶體驗證。
迴歸預防會新增 teardown 檢查與監控備註。

Security Audit

High Risk

v9 • 7/5/2026 Open versioned report

Most static findings are false positives from Markdown examples, Graphviz labels, and /dev/null redirection. The executable shell workflow has real risks from eval on a project-configured test command and repeated npx execution of a mutable alpha package. No prompt injection attempt was found in the reviewed files.

Files scanned

3,391

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

slash-command-debugging-assistant.sh:41-52 slash-command-debugging-assistant.sh:265-269

Configurable Test Command Uses eval

The shell workflow loads testCommand from .debug-config.json into DEBUG_TEST_CMD and later runs eval on that value. A malicious or untrusted project configuration can execute arbitrary shell commands when validation runs.

The data flow is direct: jq reads testCommand from local config, assigns DEBUG_TEST_CMD, and eval executes it during validation.

High

slash-command-debugging-assistant.sh:146-154 slash-command-debugging-assistant.sh:206-208 slash-command-debugging-assistant.sh:280-282

Mutable npx Package Execution

The script repeatedly invokes npx claude-flow@alpha for hooks and memory operations. The alpha tag is mutable and may fetch and execute external npm package code at runtime.

The file shows repeated runtime npx calls to claude-flow@alpha, which is external package execution through a mutable npm dist tag.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

slash-command-debugging-assistant.sh:48

Shell command substitution

export DEBUG_TEST_CMD=$(jq -r '.testCommand // "npm test"' "$config_file")

This reads .debug-config.json testCommand into DEBUG_TEST_CMD, which the script later executes with eval. A malicious or untrusted project config can control shell execution during validation.

Medium

slash-command-debugging-assistant.sh:221-222

Shell command substitution

symptoms=$(npx claude-flow@alpha memory retrieve \

This command substitution executes npx claude-flow@alpha during the workflow. The arguments are quoted, but running a mutable external npm package is a real external-command risk.

Medium

slash-command-debugging-assistant.sh:244-245

Shell command substitution

root_cause=$(npx claude-flow@alpha memory retrieve \

This command substitution executes npx claude-flow@alpha to retrieve workflow state. The command appears intentional, but mutable npx package execution remains a supply-chain risk.

Medium

slash-command-debugging-assistant.sh:392

Shell command substitution

local symptoms=$(npx claude-flow@alpha memory retrieve --key "debug/$issue_id/symptoms" 2>/dev/null