pvanalyze
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the
pvanalyzetool from its official GitHub repository (github.com/adityamandaleeka/pvanalyze) or via the standard .NET tool registry. These are well-known services and the sources are consistent with the tool's intended diagnostic purpose. - [COMMAND_EXECUTION]: The skill uses standard .NET command-line interface utilities such as
dotnet tool install,git clone, anddotnet buildto set up the environment. It further executespvanalyzeanddotnet-traceto perform data analysis and trace collection, which are routine operations for software performance engineering. - [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and processing
.nettracefiles, which are external artifacts provided by the user or generated by tracing tools. - Ingestion points: Specified in
SKILL.md(Workflow steps 1 and 2), primarily through path arguments to thepvanalyzecommand. - Boundary markers: None explicitly defined in the prompts to delimit the contents of the trace file from instructions.
- Capability inventory: The skill performs subprocess calls to
pvanalyzeanddotnet-traceacross several files, includingSKILL.mdandreferences/commands.md. - Sanitization: No specific sanitization or validation of the binary trace file structure is mentioned, though the tool itself (
pvanalyze) is responsible for safe parsing of the diagnostic data.
Audit Metadata