trt-perf-analysis

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/package_report.py utilizes subprocess.run to orchestrate the report generation workflow by invoking other internal Python scripts, such as the analyzer and the data validator. These calls are constructed using specific paths and do not involve shell evaluation of user-supplied strings.
  • [DYNAMIC_EXECUTION]: In scripts/trt_perf/layer_info.py, importlib.import_module is used to load visualization modules from a hardcoded list of internal targets. This allows for extensible reporting formats without exposing the system to arbitrary module loading.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes TensorRT performance metrics and metadata from external JSON files. This data is then used as grounding context for the AI agent to generate optimization diagnoses. While this presents an indirect injection surface, the skill implements schema validation and utilizes DOMPurify in the reporting frontend to mitigate risks associated with untrusted data processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 05:24 PM