perf
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
findto identify Elixir source files within thelib/directory. - [DYNAMIC_EXECUTION]: The skill leverages MCP tools (
mcp__tidewave__project_evalandmcp__tidewave__execute_sql_query) to run dynamic Elixir code and SQL queries against the project's database and runtime for performance analysis. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes project source code, creating a surface for indirect prompt injection where malicious content in code files could influence the agent's behavior.
- Ingestion points: Reads all
.exfiles found in thelib/directory (SKILL.md). - Boundary markers: No specific delimiters or "ignore instructions" warnings are used when processing the file content.
- Capability inventory: Includes file system scanning (
find), Elixir code execution (project_eval), SQL execution (execute_sql_query), and the ability to spawn additional analysis agents (phx:elixir-reviewer). - Sanitization: No sanitization or validation of the source code content is performed before analysis.
- [DATA_EXFILTRATION]: Accesses internal application metadata and performance data, including database execution plans (
EXPLAIN ANALYZE) and process information (Process.info), which exposes system architecture details.
Audit Metadata