perf-compare

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill executes shell commands and local scripts to perform performance testing and repository management.
  • Evidence: Use of pwsh to run tests/stress_perf/ci/Run-PerfBenchmark.ps1 and git commands for worktree management (git worktree add, git worktree remove).
  • Context: These actions are necessary to build the project, run the stress harness, and compare the current branch against the main baseline. The skill explicitly instructs the agent to use the committed orchestrator scripts rather than reimplementing the logic.
  • Indirect Prompt Injection Surface: The skill processes output generated by the performance harness to create a summary report.
  • Ingestion points: The agent is instructed to read and parse tests/stress_perf/ci/out/result.json and tests/stress_perf/ci/out/comment.md (SKILL.md).
  • Boundary markers: No explicit delimiters are used when parsing these files.
  • Capability inventory: The agent has access to pwsh, git, and dotnet tools (SKILL.md).
  • Sanitization: No explicit sanitization or validation of the JSON/Markdown content is described.
  • Context: This represents a potential surface where a compromised benchmark script or malicious input in the code being measured could attempt to influence the agent's summary report. This is a common characteristic of tools that analyze external or generated data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 09:55 PM