electron-flamegraph
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill documents standard shell commands and environment variable configurations (e.g.,
--cpu-prof,NODE_OPTIONS) for users to capture performance profiles. The instructions specify that the agent should provide these commands to the user rather than executing them directly, maintaining a safe boundary between the agent and the system environment. - [PROMPT_INJECTION]: The skill processes user-provided
.cpuprofilefiles, which creates an indirect prompt injection surface where malicious function names or URLs could attempt to influence agent behavior. However, the analysis script performs schema validation and extracts specific numeric metrics, providing a summarized report to the agent rather than raw trace content, which effectively mitigates the risk. - Ingestion points: The
scripts/analyze-cpuprofile.mjsscript reads a file path provided by the user inSKILL.md. - Boundary markers: The processing script enforces the presence of required V8 profile keys (
nodes,samples,timeDeltas) before proceeding. - Capability inventory: The skill identifies performance bottlenecks (e.g., synchronous I/O, GC pressure) and suggests code-level optimizations based on the structured summary.
- Sanitization: The script uses standard
JSON.parse()and aggregates data into structured categories before presentation to the agent.
Audit Metadata