benchmark
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to measure build performance, which involves executing local development tools including Docker, TypeScript compilers, linters, and test suites. While intended for benchmarking, this grants the agent the ability to invoke various system processes.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from potentially untrusted external sources which could contain malicious instructions.
- Ingestion points: External target URLs (Mode 1: Page Performance) and API endpoints (Mode 2: API Performance) as described in
SKILL.md. - Boundary markers: None specified; instructions do not explicitly tell the agent to ignore or delimit instructions found within the fetched content.
- Capability inventory: The skill writes JSON files to the local file system (
.ecc/benchmarks/) and executes shell commands for build, lint, and container operations as described inSKILL.md. - Sanitization: None specified; the skill does not detail any filtering or validation steps for the content retrieved from external sources before it is processed by the agent.
Audit Metadata