saleae-logic2-embedded-debug
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions direct the agent to interpret data from repository files (such as READMEs, source code, and devicetrees) and exported CSV data tables to configure debugging workflows. This creates a vulnerability surface where malicious instructions embedded in these files could influence agent behavior.
- Ingestion points: Repository files (firmware headers, board configurations, and documentation) and Saleae CSV data exports are used as input for logic derivation.
- Boundary markers: The skill prompt does not provide explicit delimiters or instructions to the agent to treat repository data as untrusted content.
- Capability inventory: The skill facilitates local file system writes (for artifacts and extension scaffolding), executes local commands via git, and interacts with hardware via the Saleae Logic 2 API.
- Sanitization: There is minimal validation or sanitization of data derived from the analyzed repository before it is used in script generation.
- [EXTERNAL_DOWNLOADS]: The skill documentation references the
logic2-automationpackage, which is the official Python library provided by Saleae for hardware control. - [COMMAND_EXECUTION]: The environment check script executes
git rev-parse --show-toplevelas a subprocess to determine the repository root path.
Audit Metadata