spatial-app-performance-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the Python
subprocessmodule to execute local CLI tools. Specifically,capture_perf_data.py,check_device.py,check_debuggable.py, andcheck_foreground.pyutilizeadbto interact with connected Android devices. Additionally,query_report_data.py,run_query.py, andspatial_probe.pyexecutepico-clifor trace loading and SQL querying. This is a core functional requirement for the skill's performance analysis mission. - [DYNAMIC_EXECUTION]: In
generate_report.py, the skill dynamically assembles a performance report by injecting JSON data into an HTML/JavaScript template. It further usessubprocessto runnode --checkon a temporary file containing the generated JavaScript to validate its syntax. While this involves writing and verifying code at runtime, it is used here as a validation step for report generation. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting and interpreting external data from Perfetto performance traces (via
pico-cli perf trace queryresults). This creates a surface where the agent's conclusions could be influenced by content within the trace files, although the risk is mitigated by the use of structured SQL queries and the technical nature of the data.
Audit Metadata