performance-and-caching
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests production telemetry and metrics (e.g., latency, error rates, and cache hit rates) via the Vercel CLI to identify performance optimization candidates. This constitutes a data ingestion surface where external telemetry influences the generation of optimization recommendations.
- Ingestion points: The audit pipeline in
TELEMETRY-AUDIT.mdandVERCEL-METRICS.mdfetches metrics using commands likevercel metricsandvercel usage. - Boundary markers: The skill employs mechanical thresholds and pure-function logic for candidate selection to reduce the risk of adversarial data influencing agent behavior.
- Capability inventory: The skill possesses capabilities to execute the Vercel CLI and read repository source files for analysis.
- Sanitization: The skill includes a dedicated step in
TELEMETRY-AUDIT.mdfor sanitizing findings and verifying recommendations against the actual source code and observed metrics. - [DYNAMIC_EXECUTION]: The skill uses subprocess execution via the Vercel CLI tool to gather necessary telemetry for its performance audits.
- Evidence:
VERCEL-METRICS.mddocuments the use ofvercel metrics,vercel whoami, andvercel usageto retrieve project configuration and performance data. This execution is scoped to the skill's primary function of performance auditing. - [EXTERNAL_DOWNLOADS]: The skill references and suggests the integration of several external Node.js packages and development tools.
- Evidence:
CACHING.mdandMEASURE.mdrecommend libraries such asioredis,lru-cache, andbetter-allfor managing cache states and asynchronous task concurrency. - Evidence:
QUERIES.mdprovides instructions for pulling and running the official PostgreSQL Docker image (postgres:17) to facilitate local benchmarking and query plan analysis.
Audit Metadata