build-performance-analysis
Warn
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses 'Start-Process -Verb RunAs' to execute privileged commands. This triggers a UAC prompt to grant the user ETW tracing rights. The skill mitigates this by using the 'ask_user' tool for explicit consent.
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'vcperf' utility from a Microsoft Azure DevOps NuGet feed. The download originates from a well-known service and is performed during the initial setup phase.
- [REMOTE_CODE_EXECUTION]: The agent executes the 'vcperf.exe' binary after downloading it, as well as build tools like 'msbuild' and 'cmake'. Executable paths are resolved dynamically at runtime.
- [PROMPT_INJECTION]: The skill processes JSON output from the 'vcperf' tool, creating a surface for indirect prompt injection. Ingestion points: 'SKILL.md' (Core Workflow Step 3). Boundary markers: Absent. Capability inventory: Command execution (vcperf, msbuild, cmake) and file writes. Sanitization: Absent.
Audit Metadata