hz-perfetto-debug

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use npx to download and execute the metavr tool from the NPM registry. Since metavr is a tool associated with the vendor meta-quest and NPM is a trusted package registry, this follows standard development practices for performance analysis.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands (metavr, npx) to capture, list, load, and query Perfetto traces from Meta Quest devices. These commands are restricted to the allowed-tools configuration and are used exclusively for legitimate VR performance debugging.
  • [SAFE]: File system access is limited to searching for and loading performance trace files (.pftrace) within standard user directories such as ~/Documents, ~/Downloads, and the current working directory.
  • [SAFE]: The skill's instructions focus on analyzing frame timing, CPU/GPU bottlenecks, and thread states using standard Perfetto SQL queries, with no evidence of prompt injection, data exfiltration, or malicious persistence.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 06:57 PM
Security Audit — agent-trust-hub — hz-perfetto-debug