ulw-perf
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to identify, record, and execute an "evaluator command" or "measurement command" to establish performance baselines and verify fixes. This involves the execution of shell commands provided by the user or discovered in the environment.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data including symptom descriptions, reproduction workloads, and evaluator commands provided by the user.
- Ingestion points: Inputs such as
workload,evaluator command, andsymptomare processed to drive the optimization loop. - Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the workload data.
- Capability inventory: The skill utilizes the
omhruntime tool and executes arbitrary shell commands defined as the evaluator. - Sanitization: There is no mention of sanitization, validation, or escaping of the user-provided workloads or commands before execution.
Audit Metadata