skills/albertmartorell1975/android-ai-workflow-foundation/perfetto-trace-analysis/Gen Agent Trust Hub
perfetto-trace-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
trace_processorutility fromhttps://get.perfetto.dev/trace_processor. This source is a well-known service associated with the official Perfetto project. - [REMOTE_CODE_EXECUTION]: The skill downloads and then executes a Python wrapper script (
trace_processor). This tool is essential for the skill's primary function of trace analysis and originates from a well-known service. - [COMMAND_EXECUTION]: The skill invokes shell commands such as
curl,chmod, and the./trace_processorscript to perform analysis tasks. These operations are limited to the workspace and are standard for debugging tools. - [PROMPT_INJECTION]: The skill permits the execution of user-provided SQL queries, which is a potential surface for indirect prompt injection. This is mitigated by a mandatory validation loop.
- Ingestion points: External Perfetto trace files and user-provided SQL queries.
- Boundary markers: Not explicitly present for trace data; uses a step-by-step verification process for SQL queries.
- Capability inventory: Subprocess execution of the
trace_processoranalysis tool. - Sanitization: Includes an 'Execution Protocol' with a checklist (Step 2) to validate SQLite syntax, table existence, and safety constraints before any query is run.
Audit Metadata