performance-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation defines multiple commands using the
npx claude-flowutility to perform bottleneck detection, apply automated fixes, and generate performance reports. \n- [REMOTE_CODE_EXECUTION]: The skill includes a Node.js integration example that programmatically executes shell commands usingchild_process.exec, including thenpxpackage runner which dynamically fetches and executes code from the npm registry. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes task metrics and swarm results, creating an ingestion surface for untrusted external data. Evidence: 1. Ingestion points: Performance metrics and task results (SKILL.md). 2. Boundary markers: Not present in integration examples. 3. Capability inventory:child_process.execandfs.writeFileSync(SKILL.md). 4. Sanitization: Not demonstrated in provided code samples.
Audit Metadata