pvanalyze
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the pvanalyze package via the dotnet tool command and to clone its source code repository from GitHub.
- [REMOTE_CODE_EXECUTION]: The skill provides an installation path that involves cloning a remote repository and executing the source code through the dotnet run command.
- [COMMAND_EXECUTION]: The skill utilizes several system-level CLI commands for profiling and trace analysis, including dotnet-trace, pvanalyze, and dotnet build.
- [PROMPT_INJECTION]: An indirect prompt injection surface is present as the skill is designed to ingest and process untrusted .nettrace files. * Ingestion points: The skill reads and parses external trace files provided as arguments to analysis commands. * Boundary markers: There are no specific delimiters or instructions to ignore potential commands embedded in the trace data. * Capability inventory: The agent has permissions to execute shell commands and interact with the file system. * Sanitization: The instructions do not define sanitization or verification steps for the input trace artifacts prior to processing.
Audit Metadata