profiling-analysis
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Multiple scripts use the
subprocessmodule to manage the analysis workflow. For instance,performance_analysis_main_process.pyandop_perf_analysis_combine.pyexecute sub-scripts usingpythonto perform specialized analysis tasks.detect_slow_rank.pyalso executes themsprof-analyzecommand-line utility. - [EXTERNAL_DOWNLOADS]: The script
detect_slow_rank.pycontains logic in theinstall_msproffunction to download and install themstttool from the official repository athttps://gitee.com/ascend/mstt.gitusinggit cloneandpip install. This is an official resource from the vendor used for runtime environment setup. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its reporting mechanism. The script
op_pivot_table_analyzer.pyreads data from user-provided files such asop_statistic_*.csvandkernel_details.csvand interpolates fields like 'Input Shapes' directly into HTML<td>tags. A lack of sanitization allows potentially malicious data within these files to influence the content of the generated HTML report (e.g.,op_analysis_combined.html).
Audit Metadata