Skills
skills/jeremylongshore/claude-code-plugins-plus-skills/gamma-debug-bundle/Gen Agent Trust Hub

gamma-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFECREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The debug/check-env.ts script prints the first eight characters of the GAMMA_API_KEY to the console. While it's a partial key, exposing secrets in logs is a potential security risk.\n- [DATA_EXFILTRATION]: The skill implements interceptors in debug/gamma-debug.ts to capture full requestBody and responseBody of API calls, which are then saved to gamma-debug-bundle.json. This may inadvertently capture PII or session tokens contained in the payloads.\n- [COMMAND_EXECUTION]: The skill utilizes the Bash(node:*) tool to run diagnostic scripts, granting it broad execution capabilities on the host environment for troubleshooting tasks.\n- [PROMPT_INJECTION]: The diagnostic script in debug/diagnose.ts ingests and logs data directly from the Gamma API without sanitization, presenting an indirect prompt injection surface.\n
  • Ingestion points: gamma.presentations.list and gamma.presentations.create in debug/diagnose.ts.\n
  • Boundary markers: Not utilized in log formatting.\n
  • Capability inventory: Bash(node:*), Write, Edit, Read, Grep.\n
  • Sanitization: None; API response data is logged verbatim.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 02:01 AM