ios-ettrace-performance

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Dependencies: The skill fetches the ettrace utility via Homebrew and clones the ETTrace source code from its official GitHub repository. These actions are necessary to provide the host-side runner and the simulator-specific framework required for profiling.\n- Command Execution: The skill utilizes standard macOS development tools, including xcodebuild for framework compilation and dwarfdump for symbolication verification. It also runs the ettrace CLI to capture performance data.\n- Data Ingestion Surface: The skill includes a Python script to process JSON flamegraph data. This script incorporates validation checks to ensure the data matches the expected format from the profiling tool.\n- Indirect Prompt Injection Consideration: As the skill processes output generated by external tools, it has an inherent surface for indirect prompt injection. The skill implements specific evidence of this surface through its ingestion point in analyze_flamegraph_json.py, though the risk is minimized by the structured nature of the performance data and the specific schema validation implemented in the analysis script.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 01:52 PM
Security Audit — agent-trust-hub — ios-ettrace-performance