profile-dart-code
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Dart script (
scripts/bin/profile.dart) that usesProcess.startto launch target Dart applications with VM service observability enabled. This is the core intended functionality for a profiling tool. The implementation uses best practices by passing arguments as a list rather than a single shell string, reducing the risk of shell injection. - [EXTERNAL_DOWNLOADS]: The project depends on official and well-known Dart packages (such as
vm_service,args, andcli_util) from the standard pub.dev registry. These are appropriate for the skill's purpose and originate from trusted ecosystems. - [DATA_EXPOSURE]: The script connects to the Dart VM Service via a local WebSocket (
ws://127.0.0.1) to retrieve performance samples. This communication is restricted to the local machine and is the standard method for out-of-process profiling.
Audit Metadata