perf-benchmark
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto orchestrate multiple system profiling tools, includingvalgrind,perf, andobjdump, which is necessary for its function as a performance monitor. - [COMMAND_EXECUTION]: In the
tracemallocstage, the skill dynamically generates a temporary Python wrapper script. This script utilizesrunpyandexec()to execute the target benchmark code within a monitored environment, a standard practice for non-intrusive memory profiling. - [PROMPT_INJECTION]: The skill performs autodiscovery of benchmark tests by scanning the target repository for files matching
test_*.py. This functionality constitutes an indirect prompt injection surface as it could lead to the execution of malicious code if the scanned repository is compromised. - Ingestion points: Filesystem scanning of the user-provided
--rootdirectory inscripts/perf_benchmark/support.py. - Boundary markers: None; the skill assumes the local repository content is trusted by the user.
- Capability inventory: Use of
pytestandvalgrindto execute discovered test files inscripts/perf_benchmark_pipeline.py. - Sanitization: None; discovered file paths are passed directly to subprocess execution commands.
Audit Metadata