performance-profiler
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing well-known performance engineering tools (e.g., clinic.js, py-spy, k6) from official package registries like npm and pip. These are recognized industry-standard tools.- [COMMAND_EXECUTION]: The provided recipes include a variety of CLI commands for CPU profiling, memory snapshots, and load testing. These commands are intended for performance diagnostics and are executed within the user's local development environment.- [INDIRECT_PROMPT_INJECTION]: The analysis script (performance_profiler.py) reads filenames and dependency configuration files (package.json, requirements.txt, go.mod) from the local project. This represents a potential ingestion surface for indirect prompt injection if the project directory contains malicious file names designed to confuse the agent, although the script itself does not perform any high-risk operations with this data.
Audit Metadata