profile-optimizer
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a robust framework for performance optimization, mapping measured data from React and Chrome profiles to actionable code-level fixes.- [COMMAND_EXECUTION]: The skill executes local shell commands such as 'jq', 'file', and 'gunzip' to detect and process profile formats. It also runs internal Node.js scripts ('scripts/heap-summary.mjs' and 'scripts/heap-diff.mjs') to analyze memory usage. These commands are used strictly for data processing consistent with the skill's described purpose.- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted profile data (JSON) and interpolates extracted strings into reports. \n
- Ingestion points: Profile files (.json, .heapsnapshot, etc.) are processed by rules like 'rules/input-detection.md' and analysis scripts. \n
- Boundary markers: Extracted content such as function names and URLs are displayed in templates (e.g., 'templates/analysis-report.md') without specific safety delimiters. \n
- Capability inventory: The skill can read local files and execute shell commands through its analysis scripts. \n
- Sanitization: No sanitization of the content extracted from profile data is performed prior to its inclusion in the final report.
Audit Metadata