asynkron-profiler
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the
asynkron-profilertool along with Microsoft'sdotnet-traceanddotnet-gcdumputilities from the NuGet package registry. - [COMMAND_EXECUTION]: Executes shell commands to build and profile applications, which is necessary for functionality but involves running arbitrary code during the build process.
- [PROMPT_INJECTION]: The skill processes external diagnostic artifacts (e.g.,
.nettrace,.speedscope.json) to provide analytical reports, creating a surface for indirect prompt injection. - Ingestion points: Artifact files are loaded via the
--inputflag inSKILL.md. - Boundary markers: No specific delimiters or warnings are used to separate untrusted artifact data from instructions.
- Capability inventory: The skill can execute shell commands, build code, and perform file system operations.
- Sanitization: The toolchain does not explicitly sanitize or validate the content of the diagnostic artifacts before presentation to the agent.
Audit Metadata