performance-profiler
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several local shell commands for performance analysis, including
python3 scripts/performance_profiler.py,py-spy,go tool pprof, andk6. These commands are standard for the skill's stated purpose of performance engineering and profiling. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes untrusted external data.
- Ingestion points: Project source files located at the path provided to the profiler, and database outputs such as
EXPLAIN ANALYZEresults or slow query logs. - Boundary markers: None identified. The skill does not specify delimiters or warnings to ignore instructions embedded within the files being analyzed.
- Capability inventory: The skill has the capability to execute shell commands (via
python3,py-spy, etc.) and perform database queries. - Sanitization: No evidence of sanitization or validation of the content of the project files or log data before processing or interpolation into prompts was found.
Audit Metadata