lanterna-profiler
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to perform profiling and workload generation.
- Uses the
lanternaCLI (or its npx equivalent) torunorattachto Node.js processes. - Runs benchmarking tools like
autocannonandartilleryas part of profiling workloads. - Uses
jqto query and process profiling report data. - [EXTERNAL_DOWNLOADS]: Fetches the core profiling tool and workload generators from the npm registry.
- Downloads
@lanterna-profiler/clivia npx if not locally available. - Downloads well-known benchmarking packages
autocannonandartilleryto generate traffic during profiling. - [REMOTE_CODE_EXECUTION]: Uses
npx -yto dynamically download and execute CLI tools from the npm registry. While this involves executing remote code, the tools are industry-standard or central to the skill's documented purpose. - [PROMPT_INJECTION]: The skill processes external data which serves as a potential surface for indirect prompt injection.
- Ingestion points: Profiling reports (JSON/Text) and project source files (read during analysis).
- Boundary markers: None. Content from reports and source files is processed without explicit delimiters or "ignore" instructions.
- Capability inventory: The skill possesses the ability to execute shell commands and read/write files.
- Sanitization: No explicit sanitization or validation of the ingested profiling data or source code is performed prior to analysis.
Audit Metadata