gravitas-perf
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to perform code analysis and benchmarking.
- Evidence: Commands such as
grep,autocannon,node,du, andnpxare included inSKILL.mdto identify performance bottlenecks and measure latencies. - [EXTERNAL_DOWNLOADS]: The skill references external tools that may be downloaded from public registries at runtime.
- Evidence: Uses
npx bundlesize, which fetches the package from the npm registry if it is not already available in the local environment. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent reads and analyzes external project files, which creates a potential surface for indirect prompt injection.
- Ingestion points: Project source code files (e.g.,
src/**/*.ts) are scanned usinggreppatterns defined inSKILL.md. - Boundary markers: No specific delimiters or instructions to ignore embedded prompts in the scanned files are provided.
- Capability inventory: The agent has shell execution capabilities including
grep,autocannon,node,npx, anddu. - Sanitization: No explicit sanitization or filtering of the file content is performed before processing.
Audit Metadata