rspack-tracing
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes trace data generated by Rspack builds using the
scripts/analyze_trace.mjsscript.\n - Ingestion points: The analysis script reads a
trace.jsonfile provided by the user via command-line arguments.\n - Boundary markers: The script treats the input as line-delimited JSON, establishing a clear structure for parsing events.\n
- Capability inventory: Script functionality is strictly limited to reading the local trace file and logging performance statistics to the console. It contains no network operations, file writing capabilities, or subprocess execution.\n
- Sanitization: Input data is sanitized through
JSON.parse()for events andparseFloat()for duration values, preventing the injection of malicious logic into the script's execution path.
Audit Metadata