flame-graph-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret external data from profiler outputs (e.g., folded stack text files, SVGs, or JSON).
- Ingestion points: Reads folded stacks (
folded.txt) and profiler output files (flame.html, SVG, JSON) as specified inSKILL.md. - Boundary markers: None identified; instructions do not explicitly advise the agent to ignore potentially malicious content embedded within stack trace function names.
- Capability inventory: The skill uses basic shell commands (
sort,head) and references external profiler execution (npx clinic,py-spy) inSKILL.mdandreferences/capturing-and-interpreting-flame-graphs.md. - Sanitization: No specific sanitization or escaping logic is described for the ingested stack trace data.
- [EXTERNAL_DOWNLOADS]: The skill documentation references the use of standard, well-known performance diagnostic tools.
- The skill suggests using
npx clinic flame, which downloads and executes the Clinic.js package from the npm registry. - It references other established tools including
py-spy(Python),async-profiler(JVM), and Brendan Gregg'sflamegraph.plscripts. These are industry-standard tools for performance engineering.
Audit Metadata