perf-profiling
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes user-provided source code and performance logs to identify bottlenecks, creating a surface for indirect instructions. \n
- Ingestion points: Application source code and performance output logs accessed via Read, Grep, and Glob tools. \n
- Boundary markers: Absent; the skill lacks specific delimiters or warnings to ignore instructions embedded in the analyzed project data. \n
- Capability inventory: The skill has access to the Bash tool for arbitrary shell command execution and the Read tool for local file system access. \n
- Sanitization: Absent; no methodology is provided for escaping or validating content read from the external environment.\n- [COMMAND_EXECUTION]: The skill's protocol involves using the Bash tool to run various system-level profiling and benchmarking utilities, including node --prof, perf, hyperfine, wrk, and k6. While standard for performance tasks, these tools execute with the agent's privileges.\n- [EXTERNAL_DOWNLOADS]: The skill suggests utilizing several third-party performance tools such as clinic.js, 0x, hyperfine, wrk, k6, and vegeta. These represent external dependencies that are commonly used in the industry for measurement and benchmarking.
Audit Metadata