slate-ar-perf
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run various local project commands using
pnpm(such asbench:targets:listandbench:targets:check) andnode(specificallytooling/scripts/bench-targets.mjs). These operations are used to manage performance benchmarks and are restricted to the local development environment. - [DATA_EXFILTRATION]: Analysis of network operations shows only a reference to a local development server (
http://localhost:3100). There is no evidence of data transmission to external or untrusted domains. - [PROMPT_INJECTION]: The skill incorporates external data from a local registry file (
benchmarks/targets/slate-v2.json) and user-provided arguments. While this creates an indirect prompt injection surface, the risk is mitigated by the skill's focus on structured performance testing within a specific project context. - Ingestion points: Reads data from
benchmarks/targets/slate-v2.jsonand user-provided$ARGUMENTS. - Boundary markers: None identified for distinguishing instruction from data.
- Capability inventory: Execution of shell commands via
pnpmandnodescripts (referenced inSKILL.md). - Sanitization: Not explicitly described for external data interpolation.
Audit Metadata