gpui-bench
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard Rust and macOS development utilities, including
cargo tree,cargo bench,dsymutil, andxctrace. These commands are scoped to the primary purpose of benchmarking and profiling within a controlled development environment. - [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of processing potentially sensitive external data (profiling traces and benchmark reports). It explicitly directs the agent to 'never paste raw trace metadata into a shared thread' and to focus only on summarized, non-sensitive exports, mitigating data exposure risks.
- [SAFE]: The skill implements significant safety constraints, including a non-negotiable five-minute timeout (
timeout_ms <= 300000) for all benchmark and profile invocations to prevent resource exhaustion or hang conditions. It also enforces strict feature isolation to prevent the accidental execution of test-only code during performance measurements.
Audit Metadata