1k-startup-profile

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill documents a profiling mechanism that monkey-patches the React Native Metro require function (__r) at runtime. This allows the system to measure the self-time and inclusive time of JavaScript modules during the app startup sequence.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions provide bash scripts to process application logs for performance metrics.
  • Ingestion points: Application logs (app-latest.log) containing module paths and execution timings.
  • Boundary markers: None present.
  • Capability inventory: The instructions utilize standard Unix utilities including grep, awk, sort, and sed.
  • Sanitization: None present. While these tools are used for developer-led diagnostics, processing logs that might contain external data presents a theoretical indirect injection surface.
  • [COMMAND_EXECUTION]: The documentation includes several bash command examples for setting environment variables (e.g., export ONEKEY_STARTUP_PROFILE=1), building the mobile application (e.g., yarn app:android), and performing log aggregation. These commands are intended for manual execution by developers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 08:38 PM
Security Audit — agent-trust-hub — 1k-startup-profile