performance-profiling

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a diagnostic script (scripts/analyze-performance.sh) that executes standard Linux system utilities such as uname, nproc, vmstat, and iostat to gather performance metrics. This behavior is consistent with the skill's primary purpose and poses no security risk in this context.\n- [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect injection by ingesting system performance data (e.g., process information from /proc) and user-provided samples for statistical analysis. However, these inputs are used solely for generating diagnostic reports and mathematical analysis.\n
  • Ingestion points: Reads process-specific information from /proc/$TARGET_PID/comm and /proc/$TARGET_PID/smaps in scripts/analyze-performance.sh, and accepts user-supplied latency_samples in SKILL.md.\n
  • Boundary markers: No specific delimiters are used to isolate these inputs.\n
  • Capability inventory: The skill can write diagnostic reports to the local filesystem and execute system utilities.\n
  • Sanitization: No specific sanitization logic is implemented for the ingested metrics.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 04:39 PM