golang-performance
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard Go toolchain commands, including
go test,go build,go tool pprof, andgo tool trace, as well ascurlto capture profiling data from local endpoints. - [EXTERNAL_DOWNLOADS]: The skill references the installation of the
benchstattool fromgolang.org/x/perf, which is a well-known and trusted sub-repository of the official Go project. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external Go source code and profiling artifacts such as CPU/heap profiles and traces (ingestion points). While it utilizes shell capabilities like
go testandgo build(capability inventory) for analysis, it does so within a structured developer workflow. The skill lacks explicit prompt boundary markers or sanitization for analyzed data, but it provides security best practices, such as binding tools to localhost and warning about secret leakage in tracebacks, which aligns with its primary technical purpose.
Audit Metadata