asm-performance
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill involves installing several legitimate third-party tools for performance analysis:
cargo-show-asmis installed from the official Rust package registry.pmu-toolsis cloned from its canonical GitHub repository (https://github.com/andikleen/pmu-tools).uiCAis installed from the official Python package registry (PyPI).- [COMMAND_EXECUTION]: The workflow utilizes standard system utilities and compilers to perform its tasks, including
objdump,perf,gcc,clang,nm, andllvm-mca. These tools are necessary for the stated purpose of analyzing and measuring code performance. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes assembly code which could theoretically contain malicious instructions disguised as comments.
- Ingestion points: Assembly code collected from binaries or source files during Phase 1 (SKILL.md).
- Boundary markers: Absent. The skill uses standard markdown formatting for code blocks but does not include explicit delimiters to prevent the model from following instructions embedded in the analyzed code.
- Capability inventory: The skill has the capability to run compilers, profilers, and package managers via shell commands.
- Sanitization: Absent. The security of the operation relies on the agent's ability to maintain its objective of performance auditing while processing external code snippets.
Audit Metadata