performance-analysis
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use various CLI commands via
npx claude-flowfor bottleneck detection and report generation. - [EXTERNAL_DOWNLOADS]: The use of
npxinvolves downloading and executing packages from the official npm registry. - [REMOTE_CODE_EXECUTION]: Instructions involve running code fetched from the npm registry via
npx. This is standard behavior for Node.js-based developer tools. - [DYNAMIC_EXECUTION]: The 'Custom Analysis Scripts' section provides a JavaScript example using
child_process.execto programmatically run analysis commands. This is provided as an example for user implementation rather than a skill-automated action. - [INDIRECT_PROMPT_INJECTION]: The skill processes external swarm data (metrics, logs, and task results) which could potentially contain malicious instructions.
- Ingestion points: Performance metrics, task logs, and swarm configuration data processed during analysis.
- Boundary markers: No specific boundary markers or 'ignore' instructions are defined for the data ingestion phase.
- Capability inventory: The skill has capabilities to execute shell commands and modify configurations (via the
--fixflag). - Sanitization: No explicit sanitization of external performance data is mentioned before it is presented to the agent.
Audit Metadata