performance-scout

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection during codebase analysis.
  • Ingestion points: The agent has full codebase read access via read_file, grep, and codebase_search (specified in SKILL.md and agents/openai.yaml).
  • Boundary markers: The system prompt lacks delimiters or warnings to ignore instructions embedded in the analyzed data.
  • Capability inventory: Authorized tools include bash and python execution.
  • Sanitization: Content from the codebase is not validated or filtered.
  • [COMMAND_EXECUTION]: The skill utilizes shell-based tools for performance benchmarking.
  • Authorized execution of bash, python, and the hyperfine utility is documented for triage and analysis tasks.
  • [EXTERNAL_DOWNLOADS]: The skill accesses official Rust documentation.
  • Connects to doc.rust-lang.org to retrieve performance-related guidelines, which is a well-known documentation service.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:08 PM