The Agent Skills Directory

[SAFE]: The skill is a legitimate performance analysis tool. No malicious patterns such as obfuscation, credential harvesting, or persistence mechanisms were detected.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes external performance data (the .cpuprofile JSON) and summarizes it for the agent.
Ingestion points: scripts/analyze-cpuprofile.mjs reads the file provided by the user in Phase 2.2.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the script's output.
Capability inventory: The skill can read local files and execute its bundled analysis script.
Sanitization: The script extracts numerical data and labels (function names/URLs) from the JSON. It performs minimal sanitization (URL shortening) but does not escape all string content before presentation to the agent.
[REMOTE_CODE_EXECUTION]: The skill does not download or execute code from remote sources. All logic is local, and the recommended profiling commands are standard Node.js/Electron flags intended for manual execution by the user.

electron-flamegraph