pvanalyze

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the pvanalyze tool from its official GitHub repository (github.com/adityamandaleeka/pvanalyze) or via the standard .NET tool registry. These are well-known services and the sources are consistent with the tool's intended diagnostic purpose.
  • [COMMAND_EXECUTION]: The skill uses standard .NET command-line interface utilities such as dotnet tool install, git clone, and dotnet build to set up the environment. It further executes pvanalyze and dotnet-trace to perform data analysis and trace collection, which are routine operations for software performance engineering.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and processing .nettrace files, which are external artifacts provided by the user or generated by tracing tools.
  • Ingestion points: Specified in SKILL.md (Workflow steps 1 and 2), primarily through path arguments to the pvanalyze command.
  • Boundary markers: None explicitly defined in the prompts to delimit the contents of the trace file from instructions.
  • Capability inventory: The skill performs subprocess calls to pvanalyze and dotnet-trace across several files, including SKILL.md and references/commands.md.
  • Sanitization: No specific sanitization or validation of the binary trace file structure is mentioned, though the tool itself (pvanalyze) is responsible for safe parsing of the diagnostic data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 08:58 AM