The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill's instructions for setting up the environment and its CI/CD workflow examples explicitly use sudo to install software and modify system-protected directories, such as moving binaries to /usr/local/bin/.
[COMMAND_EXECUTION]: The skill provides numerous code examples in examples/optimization/api_optimization.ts and references/optimization-strategies.md that are highly vulnerable to SQL injection. These examples demonstrate direct string interpolation of user-controlled variables (e.g., query parameters, cursors, and field lists) into raw SQL queries without sanitization or parameterized queries.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a vulnerability surface where the agent is encouraged to analyze untrusted application code, performance profiles, and logs using powerful system tools (such as py-spy, k6, and pprof). There are no defined boundary markers or sanitization instructions for how the agent should handle potentially malicious content within these analyzed artifacts.
[EXTERNAL_DOWNLOADS]: The skill fetches tools and configuration from external repositories, including downloading the k6 binary from Grafana's official GitHub releases during CI/CD workflows and installing various third-party performance tools from NPM, PyPI, and GitHub.

performance-engineering