1k-startup-profile
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents a profiling mechanism that monkey-patches the React Native Metro require function (
__r) at runtime. This allows the system to measure the self-time and inclusive time of JavaScript modules during the app startup sequence. - [INDIRECT_PROMPT_INJECTION]: The skill instructions provide bash scripts to process application logs for performance metrics.
- Ingestion points: Application logs (
app-latest.log) containing module paths and execution timings. - Boundary markers: None present.
- Capability inventory: The instructions utilize standard Unix utilities including
grep,awk,sort, andsed. - Sanitization: None present. While these tools are used for developer-led diagnostics, processing logs that might contain external data presents a theoretical indirect injection surface.
- [COMMAND_EXECUTION]: The documentation includes several bash command examples for setting environment variables (e.g.,
export ONEKEY_STARTUP_PROFILE=1), building the mobile application (e.g.,yarn app:android), and performing log aggregation. These commands are intended for manual execution by developers.
Audit Metadata