golang-performance
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill focuses on legitimate performance engineering practices for the Go programming language, providing educational content and references to standard optimization techniques.
- [EXTERNAL_DOWNLOADS]: The skill references several external packages and tools used for performance monitoring and benchmarking. All identified sources are either official Go project repositories, well-known technology organizations (e.g., Hashicorp, Elastic, Prometheus, Grafana, Uber), or the author's own verified repositories.
- References
golang.org/x/perf/cmd/benchstatfor benchmark analysis. - References performance-oriented libraries such as
github.com/prometheus/client_golang,github.com/grafana/pyroscope-go, andgo.uber.org/automaxprocs. - [COMMAND_EXECUTION]: The instructions include standard shell commands for Go development workflows, such as running benchmarks (
go test -bench), profiling (go tool pprof), and compiling with specific flags (go build -gcflags). These are standard tools for the intended task. - [INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it processes external Go source code and profiling data. However, the skill explicitly includes a "Scope and authorization" section that instructs the agent to disregard instructions found in browsed pages, log files, or command output, which mitigates this risk.
Audit Metadata