performance-engineer
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides workflows involving the
perfutility, specificallyperf record -a. This is a standard but powerful Linux profiling tool that typically requires elevated privileges (root or specific sysctl settings) to capture system-wide data. - [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface where the agent processes external data files such as performance profiles (
out.perf) and SVG visualizations (profile.svg). - Ingestion points: The agent is instructed to generate and analyze output from
perfand Flamegraph scripts inSKILL.md. - Boundary markers: None present for the processed data.
- Capability inventory: The skill uses shell commands and script execution (
perf,perl) for profiling. - Sanitization: No specific sanitization for the captured profile data is mentioned.
- [SAFE]: The instructions and code snippets provided are consistent with the skill's stated purpose as a performance engineering tool. There are no attempts at data exfiltration, obfuscation, or unauthorized persistence.
Audit Metadata