run-agentx
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
aiperfbenchmarking harness from a third-party GitHub repository. - Evidence:
python -m pip install 'aiperf @ git+https://github.com/SemiAnalysisAI/agentx-harness.git@56a0cf70f4c0359454ee4bd15a17770b541a3e3e' - The installation uses a specific commit hash (SHA) to ensure the integrity and consistency of the external code, which is a security best practice for managing external dependencies.
- [COMMAND_EXECUTION]: The skill executes shell commands to configure the environment and run the profiling tool.
- Evidence: Uses
aiperf profileto initiate benchmarking scenarios based on user-defined environment variables. - [INDIRECT_PROMPT_INJECTION]: The skill processes external datasets that may contain untrusted data.
- Ingestion points: The
aiperftool downloads and caches public datasets and traces as defined by theAGENTX_DATASETvariable inSKILL.md. - Boundary markers: The instructions advise the agent never to silently truncate requests, but do not specify specific sanitization for dataset content.
- Capability inventory: The skill utilizes network access to communicate with inference endpoints and shell execution to run the
aiperfsuite (documented inSKILL.md). - Sanitization: The skill includes an explicit security check, advising against the use of
--tokenizer-trust-remote-codeunless the user has manually verified and trusted the repository.
Audit Metadata