hz-simpleperf-debug
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions utilize
npx -y metavrto execute the profiling utility. This pattern involves fetching the package from the npm registry at runtime. Given that metavr is a documented tool from the skill's author (meta-quest), this is categorized as intended functionality for the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze performance data produced by the metavr CLI. \n
- Ingestion points: Command output from
metavr perf simpleperfsubcommands inSKILL.mdand reference files. \n - Boundary markers: The skill does not define specific delimiters for tool output. \n
- Capability inventory: The skill uses the Bash tool to execute profiling commands and read system state. \n
- Sanitization: No explicit sanitization is applied to the performance metrics before analysis, though the technical nature of hardware performance counters naturally limits injection risks.
Audit Metadata