ln-811-performance-profiler
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is configured to download supplemental markdown instructions and reference guides from the author's public GitHub repository (levnikolaevich/claude-code-skills) when local reference files are missing. These files provide the logic for tool detection and benchmark generation templates.
- [COMMAND_EXECUTION]: The workflow involves discovering and executing a test_command to establish performance baselines. It utilizes system-level profiling utilities including /usr/bin/time, nvidia-smi, and language-specific tools like py-spy or dotnet-trace. It also employs curl for measuring the latency of API endpoints.
- [REMOTE_CODE_EXECUTION]: During the profiling process, the skill performs Targeted Instrumentation, which programmatically modifies the target application's source files by inserting timing and logging statements. These modified files are then re-executed to collect granular performance data.
- [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by reading and analyzing untrusted source code to identify performance bottlenecks.
- Ingestion points: The skill reads function bodies and traverses call hierarchies across the local filesystem (e.g., SKILL.md, Phase 2 Step 1).
- Boundary markers: No specific delimiters or instructions are provided to the agent to distinguish between its instructions and potentially malicious instructions embedded in the analyzed code.
- Capability inventory: The skill possesses capabilities to execute shell commands, modify local source files, and perform network requests.
- Sanitization: The skill does not explicitly sanitize the content of the source files before they are processed by the agent's logic.
Audit Metadata