guidance-webgpu-performance
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of local shell commands using
miseandpnpmto run performance benchmarks and test suites (e.g.,mise exec -- pnpm run test:bench). This is standard behavior for development-oriented agents working within a repository. - [DYNAMIC_EXECUTION]: The included WebGPU test suite leverages Playwright to run automated browser sessions. This involves the dynamic execution of JavaScript to orchestrate and observe the browser-based rendering pipeline.
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to read and process instructions from several repository files, such as
DEVELOPMENT.mdandpackage.json, to configure the test environment. This creates an attack surface where malicious content in these files could attempt to influence agent behavior. - Ingestion points: Reading repository files (
DEVELOPMENT.md,AGENTS.md,package.json,*.test.bench.ts) for context and configuration. - Boundary markers: No specific boundary markers or "ignore instructions" warnings are defined for the reading of these external project files.
- Capability inventory: The skill possesses capabilities for shell command execution (
pnpm) and browser automation (Playwright). - Sanitization: The skill does not implement specific sanitization or validation of the content read from the repository documentation before it is processed by the agent.
Audit Metadata