golang-performance

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use standard Go toolchain commands, including go test, go build, go tool pprof, and go tool trace, as well as curl to capture profiling data from local endpoints.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of the benchstat tool from golang.org/x/perf, which is a well-known and trusted sub-repository of the official Go project.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes external Go source code and profiling artifacts such as CPU/heap profiles and traces (ingestion points). While it utilizes shell capabilities like go test and go build (capability inventory) for analysis, it does so within a structured developer workflow. The skill lacks explicit prompt boundary markers or sanitization for analyzed data, but it provides security best practices, such as binding tools to localhost and warning about secret leakage in tracebacks, which aligns with its primary technical purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 09:45 AM