perf-benchmark

Pass

Audited by Gen Agent Trust Hub on Mar 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to orchestrate multiple system profiling tools, including valgrind, perf, and objdump, which is necessary for its function as a performance monitor.
  • [COMMAND_EXECUTION]: In the tracemalloc stage, the skill dynamically generates a temporary Python wrapper script. This script utilizes runpy and exec() to execute the target benchmark code within a monitored environment, a standard practice for non-intrusive memory profiling.
  • [PROMPT_INJECTION]: The skill performs autodiscovery of benchmark tests by scanning the target repository for files matching test_*.py. This functionality constitutes an indirect prompt injection surface as it could lead to the execution of malicious code if the scanned repository is compromised.
  • Ingestion points: Filesystem scanning of the user-provided --root directory in scripts/perf_benchmark/support.py.
  • Boundary markers: None; the skill assumes the local repository content is trusted by the user.
  • Capability inventory: Use of pytest and valgrind to execute discovered test files in scripts/perf_benchmark_pipeline.py.
  • Sanitization: None; discovered file paths are passed directly to subprocess execution commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 7, 2026, 08:24 AM