kernel-worker
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill relies on an external 'task brief' (referenced in
references/task-brief.md) to provide goals, workload descriptions, and instructions to the kernel worker sub-agent. - Ingestion points: The agent is instructed to read
task-brief.md(passed as an absolute path at runtime) and external source code/reference implementations. - Boundary markers: The instructions provide a structured template for the brief but do not specify mandatory prompt delimiters (like XML tags or block markers) to prevent the agent from mistaking data content for instructions.
- Capability inventory: The worker has the ability to write to an 'independent workspace', execute shell commands for profiling (e.g.,
msprof-ascend), and compile code (Triton/PyTorch). - Sanitization: There are no mentioned mechanisms for sanitizing the task brief or the external code before the agent processes and executes them.
- [EXTERNAL_DOWNLOADS]: The skill references an external domain for specialized knowledge and tools.
- Evidence: The file
references/kernel-knowledge.mdpoints to a repository athttps://git.nju.edu.cn/iscl/kernel-knowledge(Nanjing University Git) for domain-specific optimization skills and installation tools. - [DYNAMIC_EXECUTION]: A primary purpose of the skill is to iterate on, compile, and execute kernel code.
- Evidence: Instructions in
SKILL.mdandreferences/task-brief.mddetail a workflow involving the compilation of Triton and TileLang kernels, usage of 'Atrex' or 'KLineage' engines, and runtime performance measurement. This involves the dynamic generation and execution of code within the assigned workspace. - [COMMAND_EXECUTION]: The skill utilizes several CLI tools and scripts to perform its tasks.
- Evidence: The skill references
tools/install_skills.pyfor setup and various platform-specific profiling tools likemsprof-ascend. It also allows the use of an external execution engine (Atrex) which operates as a separate process.
Audit Metadata