benchmark
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
child_process.spawnSyncandexecFileSyncwithin its validation and timing scripts (benchmark-contract.test.mjsandpaired-timing.mjs). These are used to run legitimate internal testing and benchmarking commands (e.g.,bun bench.ts,pnpm bench,node). All command inputs are internally defined or derived from local configuration files, following the project's performance methodology. - [EXTERNAL_DOWNLOADS]: The skill includes instructions and scripts for installing internal dependencies, such as
pnpm bench:editor:install, which targets the project's ownbenchmarks/editorpackage. These are standard development workflows for the vendor 'udecode' and do not involve untrusted remote sources. - [DYNAMIC_EXECUTION]: The script
validate-benchmark-plan.mjsdynamically reads and validates local markdown files using project-specific parsers. This is a static analysis of plan files and does not execute arbitrary code or load untrusted data. - [SAFE]: The skill provides structured templates and methodologies for performance reviews and benchmarks. It includes correctness guards and verification steps to ensure that performance optimizations do not regress application behavior. All scripts and references are focused on legitimate performance engineering practices within the 'udecode' project scope.
Audit Metadata