spatial-app-performance-analysis

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the Python subprocess module to execute local CLI tools. Specifically, capture_perf_data.py, check_device.py, check_debuggable.py, and check_foreground.py utilize adb to interact with connected Android devices. Additionally, query_report_data.py, run_query.py, and spatial_probe.py execute pico-cli for trace loading and SQL querying. This is a core functional requirement for the skill's performance analysis mission.
  • [DYNAMIC_EXECUTION]: In generate_report.py, the skill dynamically assembles a performance report by injecting JSON data into an HTML/JavaScript template. It further uses subprocess to run node --check on a temporary file containing the generated JavaScript to validate its syntax. While this involves writing and verifying code at runtime, it is used here as a validation step for report generation.
  • [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting and interpreting external data from Perfetto performance traces (via pico-cli perf trace query results). This creates a surface where the agent's conclusions could be influenced by content within the trace files, although the risk is mitigated by the use of structured SQL queries and the technical nature of the data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 07:19 AM