performance-hunter
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The Multi-Level Caching pattern in
references/patterns.mddemonstrates the use ofPickleSerializerfor Redis. While standard for high-performance Python serialization, users should be cautioned thatpickleis inherently unsafe for deserializing data from untrusted sources as it can lead to arbitrary code execution. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-provided source code and performance logs (ingestion points). It lacks explicit boundary markers or sanitization instructions for this untrusted content, creating a potential surface for indirect prompt injection, although it mitigates this by grounding responses in local reference files.
- [SAFE]: No malicious patterns, persistence mechanisms, or data exfiltration attempts were detected. The skill provides pedagogical examples and validation regexes consistent with its stated purpose of performance optimization.
Audit Metadata