team-perf-opt
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted codebase data (source files, architecture docs, and project configurations) and tool outputs to generate optimization strategies and implement code changes. Maliciously crafted content in the analyzed project could potentially influence the strategist agent to propose unsafe optimizations or influence the optimizer to inject malicious code during the implementation phase.
- Ingestion points: The agent reads project files like
ARCHITECTURE.md,package.json,Cargo.toml, and various profiling/benchmark outputs across all roles (e.g.,roles/profiler/role.md,roles/benchmarker/role.md). - Boundary markers: The coordinator uses structured markdown templates in
roles/coordinator/commands/dispatch.mdto define task contexts (PURPOSE, TASK, CONTEXT, EXPECTED, CONSTRAINTS), which helps maintain boundaries between instructions and data. - Capability inventory: The skill utilizes high-authority tools including file modification (
Write,Edit), shell execution (Bash), and sub-agent spawning (Agent). - Sanitization: The workflow incorporates human-in-the-loop checkpoints (CP-1, CP-2, CP-2.5, CP-4) that require user review of bottleneck reports and optimization plans before proceeding to code modification.
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute shell commands for performance profiling, benchmarking, and session management. - Evidence:
roles/profiler/role.mdandroles/benchmarker/role.mdexecute project-specific tools likenpm,cargo bench,go test, andmake bench. The coordinator also executes platform-specificmaestroCLI commands for session orchestration inroles/coordinator/role.md. - [DYNAMIC_EXECUTION]: The profiler and benchmarker roles dynamically determine which shell commands to execute based on framework markers detected in the project codebase.
- Evidence:
roles/benchmarker/role.mdcontains a detection matrix that maps project signals (like the presence ofCargo.toml) to specific benchmark commands (likecargo bench).
Audit Metadata