performance-analysis

Pass

Audited by Gen Agent Trust Hub on Mar 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use various CLI commands via npx claude-flow for bottleneck detection and report generation.
  • [EXTERNAL_DOWNLOADS]: The use of npx involves downloading and executing packages from the official npm registry.
  • [REMOTE_CODE_EXECUTION]: Instructions involve running code fetched from the npm registry via npx. This is standard behavior for Node.js-based developer tools.
  • [DYNAMIC_EXECUTION]: The 'Custom Analysis Scripts' section provides a JavaScript example using child_process.exec to programmatically run analysis commands. This is provided as an example for user implementation rather than a skill-automated action.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external swarm data (metrics, logs, and task results) which could potentially contain malicious instructions.
  • Ingestion points: Performance metrics, task logs, and swarm configuration data processed during analysis.
  • Boundary markers: No specific boundary markers or 'ignore' instructions are defined for the data ingestion phase.
  • Capability inventory: The skill has capabilities to execute shell commands and modify configurations (via the --fix flag).
  • Sanitization: No explicit sanitization of external performance data is mentioned before it is presented to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 26, 2026, 08:45 PM