rust-profiling
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation in
reference.mdprovides a command to install thesamplyprofiling tool using a shell script hosted on its official GitHub releases page. This is a common installation method for this developer tool.\n- [COMMAND_EXECUTION]: The skill makes use of shell commands to orchestrate the build process viacargo, execute the profilersamply, and run a local Python analysis script (analyze_profile.py). These operations are consistent with the skill's stated purpose of performance analysis.\n- [DATA_EXFILTRATION]: Theanalyze_profile.pyscript reads and processes profiling data from JSON files. This data contains function names, library paths, and call stack information from the profiled application which is then displayed to the agent.\n- [PROMPT_INJECTION]: As the skill processes and displays function names and metadata from external codebases, there is a theoretical risk of indirect prompt injection if a profiled binary contains maliciously named symbols (e.g., function names containing instructions). However, this is an inherent characteristic of development tools that display code metadata.
Audit Metadata