hz-vr-debug
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
hzdbCLI tool via a Bash execution environment to perform administrative actions on connected Meta Quest devices. This includes listing processes, managing application lifecycles (launch/stop/install/uninstall), and modifying the device filesystem (push/pull/rm). These operations are consistent with the skill's primary purpose of VR application debugging. - [EXTERNAL_DOWNLOADS]: The documentation instructs the user to install the
@meta-quest/hzdbpackage from the NPM registry. This package is the core component of the skill and is maintained by the vendor (Meta Quest), aligning with established developer workflows for Quest hardware. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via untrusted data retrieved from the connected device.
- Ingestion points: The agent retrieves and processes live system logs (
hzdb adb logcat), application output, and device file listings. - Boundary markers: There are no explicit instructions or delimiters provided to prevent the agent from following instructions potentially embedded in log messages or file names.
- Capability inventory: The agent has access to the
Bash(hzdb:*)toolset, allowing it to execute device-level commands based on its interpretation of the data. - Sanitization: No sanitization or validation of log content is implemented before processing.
Audit Metadata