The Agent Skills Directory

[SAFE]: The skill provides instructional content and code snippets for Apple performance tools (Instruments, MetricKit, os_signpost). All code examples utilize standard system frameworks and follow security best practices, such as offloading heavy computation from the main thread.
[DATA_EXPOSURE]: No hardcoded credentials, sensitive file paths, or data exfiltration patterns were found. Code snippets for performance monitoring use local logging and system APIs intended for diagnostic purposes.
[EXTERNAL_DOWNLOADS]: The skill does not include any commands for external package installation (npm, pip) or remote script execution. All references are internal markdown files.
[INDIRECT_PROMPT_INJECTION]: The skill handles user-provided performance reports as input. While this is an ingestion point, the skill lacks execution capabilities (subprocess calls, file-writing, or network requests) that would make an injection exploitable.
Ingestion points: User-provided descriptions of app performance symptoms processed via the main workflow in SKILL.md.
Boundary markers: Not explicitly implemented; the skill operates as an advisory guide.
Capability inventory: No tool access or shell execution capabilities are defined in the frontmatter or references.
Sanitization: Not applicable given the lack of executable capabilities.

performance-profiling