build-performance-analysis

Warn

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses 'Start-Process -Verb RunAs' to execute privileged commands. This triggers a UAC prompt to grant the user ETW tracing rights. The skill mitigates this by using the 'ask_user' tool for explicit consent.
  • [EXTERNAL_DOWNLOADS]: The skill downloads the 'vcperf' utility from a Microsoft Azure DevOps NuGet feed. The download originates from a well-known service and is performed during the initial setup phase.
  • [REMOTE_CODE_EXECUTION]: The agent executes the 'vcperf.exe' binary after downloading it, as well as build tools like 'msbuild' and 'cmake'. Executable paths are resolved dynamically at runtime.
  • [PROMPT_INJECTION]: The skill processes JSON output from the 'vcperf' tool, creating a surface for indirect prompt injection. Ingestion points: 'SKILL.md' (Core Workflow Step 3). Boundary markers: Absent. Capability inventory: Command execution (vcperf, msbuild, cmake) and file writes. Sanitization: Absent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 1, 2026, 01:41 AM
Security Audit — agent-trust-hub — build-performance-analysis