auto-perf-optimize
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Command Execution: The skill launches the VS Code executable via shell scripts (code.sh or code.bat) using the child_process.spawn method. This is a core functionality required to automate the application for performance testing.
- Sensitive Data Management: The userDataProfile.mts utility allows for the duplication of VS Code profiles, which can include authentication tokens. The skill includes explicit instructions for the agent to handle this data securely and avoid sharing it externally.
- Dynamic Context Interaction: The automation uses Playwright to interact with the VS Code workbench. This includes executing JavaScript within the browser context via page.evaluate to drive the UI, which is necessary for the performance investigation workflow.
- Indirect Prompt Injection Surface: The skill involves processing responses from an automated Chat interface. While this presents a potential surface for indirect instructions, the skill documentation advises the use of isolated workspaces and safe commands to maintain a secure environment. Ingestion points: Chat response text in chat-memory-smoke.mts. Boundary markers: Relies on observed UI state; no explicit prompt-level delimiters. Capability inventory: Subprocess spawning, UI automation, and file system writes. Sanitization: Relies on agent adherence to safety guidelines provided in the skill documentation.
Audit Metadata