perfetto-trace-analysis
Warn
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: MEDIUMMETADATA_POISONINGEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The YAML frontmatter lists 'Google LLC' as the author, which does not match the actual author identity. This deceptive metadata may lead users to believe the skill is an official product from the platform vendor.
- [EXTERNAL_DOWNLOADS]: Fetches the trace_processor script from the official Perfetto domain (https://get.perfetto.dev/trace_processor), a well-known resource provided by a trusted organization.
- [REMOTE_CODE_EXECUTION]: Downloads and executes the trace_processor script from an official source.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Perfetto trace files. 1. Ingestion points: user-provided trace files. 2. Boundary markers: Absent. 3. Capability inventory: Tool execution and file system access. 4. Sanitization: Provides patterns for safe SQL data extraction.
- [COMMAND_EXECUTION]: Uses the trace_processor utility to execute SQL queries and metrics.
Audit Metadata