1k-perf-optimizer
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js scripts and system utilities to automate performance diagnostics. It runs
node development/perf-ci/run-ios-perf-detox-release.jsto perform iOS performance tests and utilizes tools likejq,grep, andgitto analyze results and manage code changes. - [INDIRECT_PROMPT_INJECTION]: The skill processes external log data which could technically contain instructions influencing agent behavior.
- Ingestion points: The agent reads performance metrics, timestamps, and function call traces from files in
~/perf-sessions/(e.g.,mark.log,function_call.log, andsessions.overview.jsonl). - Boundary markers: The instructions do not define clear delimiters or use 'ignore-instructions' blocks when interpolating log data into the prompt context.
- Capability inventory: The skill has the ability to execute shell commands, write iteration reports to the workspace, and perform Git operations including checkout, add, and commit.
- Sanitization: Log data is processed using standard CLI tools (
grep,jq) without additional sanitization or filtering to prevent the execution of embedded natural language instructions.
Audit Metadata