ai-cli-benchmark
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a framework for performance and cost benchmarking of AI CLI tools.
- [DATA_EXFILTRATION]: The instructions include specific security best practices, such as using isolated temporary directories and environment variables (
COPILOT_HOME,CODEX_HOME) to prevent sensitive credentials or session data from leaking into logs or child processes. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data via a JSON validator script (
scripts/helper.py). The script implements strict structural and type validation (e.g., verifying SHA-256 hash lengths and numeric token counts), which mitigates risks associated with processing untrusted benchmark data. - [COMMAND_EXECUTION]: The skill uses a helper script for data validation. The script is written in standard Python and performs file reading and JSON parsing without invoking shell commands or dynamic code execution.
Audit Metadata