asm-performance

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill involves installing several legitimate third-party tools for performance analysis:
  • cargo-show-asm is installed from the official Rust package registry.
  • pmu-tools is cloned from its canonical GitHub repository (https://github.com/andikleen/pmu-tools).
  • uiCA is installed from the official Python package registry (PyPI).
  • [COMMAND_EXECUTION]: The workflow utilizes standard system utilities and compilers to perform its tasks, including objdump, perf, gcc, clang, nm, and llvm-mca. These tools are necessary for the stated purpose of analyzing and measuring code performance.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes assembly code which could theoretically contain malicious instructions disguised as comments.
  • Ingestion points: Assembly code collected from binaries or source files during Phase 1 (SKILL.md).
  • Boundary markers: Absent. The skill uses standard markdown formatting for code blocks but does not include explicit delimiters to prevent the model from following instructions embedded in the analyzed code.
  • Capability inventory: The skill has the capability to run compilers, profilers, and package managers via shell commands.
  • Sanitization: Absent. The security of the operation relies on the agent's ability to maintain its objective of performance auditing while processing external code snippets.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 09:45 AM