benchmark-runner

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides shell commands and scripts in references/environment-capture.md to capture hardware and software context. These include the use of system tools such as lscpu, sysctl, nproc, free, and lsblk, as well as package listing commands like pip freeze and npm list to document the environment for reproducibility.
  • [PRIVILEGE_ESCALATION]: In references/test-case-design.md, the skill documents the use of sudo cpupower to fix the CPU frequency governor. This is a common practice in benchmarking to reduce measurement variance but involves an instruction to execute a command with elevated privileges.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting external data, such as candidate names, versions, and workload definitions, to generate benchmark reports. 1. Ingestion points: Phase 1 (Define Scope) in SKILL.md. 2. Boundary markers: Absent in the provided templates. 3. Capability inventory: File-write for report generation and shell command execution for environment capture. 4. Sanitization: Absent in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 09:09 AM