The Agent Skills Directory

[SAFE]: The skill provides detailed and professional guidance for macOS performance analysis, adhering to Apple's documented standards and best practices for memory, energy, and CPU profiling.
[COMMAND_EXECUTION]: The skill relies on numerous macOS system utilities (top, ps, pgrep, find, pmset, xctrace, sample, spindump, leaks, heap, vmmap, footprint) to collect metrics. These commands are used as intended for the skill's stated purpose of performance monitoring.
[PRIVILEGE_ESCALATION]: The instructions identify tools requiring root privileges (spindump, powermetrics, timerfires) and explicitly guide the agent to handle scenarios where sudo is unavailable by gracefully degrading functionality and documenting the limitation in the final report. This is a secure and transparent handling of privilege requirements.
[EXTERNAL_DOWNLOADS]: The skill references technical documentation from Apple's official developer domain (developer.apple.com), which is a well-known and trusted service. These references are used neutrally for technical reference and do not involve remote code execution.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by ingesting untrusted data from the local environment and using it to execute shell commands.
Ingestion points: User-provided app names, process IDs (PIDs), and bundle paths; project configuration files (Package.swift, tauri.conf.json, package.json) discovered via find in the working directory.
Boundary markers: None implemented in the command construction logic to separate untrusted inputs from command flags.
Capability inventory: Extensive shell execution capabilities through multiple profiling and system analysis tools across all reference files; file writing to /tmp and local project directories.
Sanitization: No specific sanitization or validation of the ingested strings is performed in the instructions, relying on the agent's internal execution environment safety.

macos-app-performance