hz-perfetto-debug
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@meta-quest/hzdbglobal package from npm. This is a vendor-owned resource for the Meta Quest ecosystem and is considered a legitimate dependency for the skill's purpose. - [COMMAND_EXECUTION]: The skill makes extensive use of the
hzdbCLI tool via Bash commands to capture performance traces from VR devices, load them into a local environment, and execute SQL queries against the trace data. These operations are restricted to the functionality provided by the vendor tool. - [PROMPT_INJECTION]: The skill is subject to potential indirect prompt injection as it processes external
.pftracefiles that may contain untrusted data. * Ingestion points: External trace files are loaded and parsed viahzdb perf load. * Boundary markers: No explicit delimiters or instructions are provided to the agent to treat trace data as untrusted. * Capability inventory: The skill has the capability to execute Bash commands through thehzdbtool. * Sanitization: There is no evidence of sanitization for the performance data or SQL query results before they are interpreted by the agent.
Audit Metadata