gravitas-perf

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to perform code analysis and benchmarking.
  • Evidence: Commands such as grep, autocannon, node, du, and npx are included in SKILL.md to identify performance bottlenecks and measure latencies.
  • [EXTERNAL_DOWNLOADS]: The skill references external tools that may be downloaded from public registries at runtime.
  • Evidence: Uses npx bundlesize, which fetches the package from the npm registry if it is not already available in the local environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent reads and analyzes external project files, which creates a potential surface for indirect prompt injection.
  • Ingestion points: Project source code files (e.g., src/**/*.ts) are scanned using grep patterns defined in SKILL.md.
  • Boundary markers: No specific delimiters or instructions to ignore embedded prompts in the scanned files are provided.
  • Capability inventory: The agent has shell execution capabilities including grep, autocannon, node, npx, and du.
  • Sanitization: No explicit sanitization or filtering of the file content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 07:57 AM