performance-profiling
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a diagnostic script (
scripts/analyze-performance.sh) that executes standard Linux system utilities such asuname,nproc,vmstat, andiostatto gather performance metrics. This behavior is consistent with the skill's primary purpose and poses no security risk in this context.\n- [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect injection by ingesting system performance data (e.g., process information from/proc) and user-provided samples for statistical analysis. However, these inputs are used solely for generating diagnostic reports and mathematical analysis.\n - Ingestion points: Reads process-specific information from
/proc/$TARGET_PID/command/proc/$TARGET_PID/smapsinscripts/analyze-performance.sh, and accepts user-suppliedlatency_samplesinSKILL.md.\n - Boundary markers: No specific delimiters are used to isolate these inputs.\n
- Capability inventory: The skill can write diagnostic reports to the local filesystem and execute system utilities.\n
- Sanitization: No specific sanitization logic is implemented for the ingested metrics.
Audit Metadata