lanterna-profiler

Pass

Audited by Gen Agent Trust Hub on May 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to perform profiling and workload generation.
  • Uses the lanterna CLI (or its npx equivalent) to run or attach to Node.js processes.
  • Runs benchmarking tools like autocannon and artillery as part of profiling workloads.
  • Uses jq to query and process profiling report data.
  • [EXTERNAL_DOWNLOADS]: Fetches the core profiling tool and workload generators from the npm registry.
  • Downloads @lanterna-profiler/cli via npx if not locally available.
  • Downloads well-known benchmarking packages autocannon and artillery to generate traffic during profiling.
  • [REMOTE_CODE_EXECUTION]: Uses npx -y to dynamically download and execute CLI tools from the npm registry. While this involves executing remote code, the tools are industry-standard or central to the skill's documented purpose.
  • [PROMPT_INJECTION]: The skill processes external data which serves as a potential surface for indirect prompt injection.
  • Ingestion points: Profiling reports (JSON/Text) and project source files (read during analysis).
  • Boundary markers: None. Content from reports and source files is processed without explicit delimiters or "ignore" instructions.
  • Capability inventory: The skill possesses the ability to execute shell commands and read/write files.
  • Sanitization: No explicit sanitization or validation of the ingested profiling data or source code is performed prior to analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
May 5, 2026, 01:43 PM