golang-benchmark

Warn

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: MEDIUMPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill provides instructions in references/ci-regression.md for using sudo to modify kernel-level system settings, including the CPU scaling governor, Turbo Boost, and Simultaneous Multithreading (SMT). These operations are high-privilege actions designed to stabilize performance measurements on dedicated hardware.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing several external Go tools to enhance benchmarking workflows, including benchstat from the official Go performance repository, and community tools like benchdiff from filippo.io, cob from github.com/knqyf263, and gobenchdata from go.bobheadxi.dev.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project source code and performance tool outputs, which constitutes an indirect injection surface. * Ingestion points: The skill reads Go source files (**/*.go) and benchmark output data from shell execution and log files. * Capability inventory: The skill utilizes file system modification tools (Write, Edit) and shell execution (Bash). * Boundary markers: There are no explicit delimiters or instructions to ignore potential commands embedded in source files or benchmark data. * Sanitization: There is no evidence of sanitization for data ingested from external source code or performance reports.
  • [COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to run Go test suites, profiling tools (pprof), execution tracers, and various performance utility CLI tools.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 14, 2026, 05:09 AM
Security Audit — agent-trust-hub — golang-benchmark