skills/microsoft/aspire/startup-perf/Gen Agent Trust Hub

startup-perf

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill utilizes local shell scripts (restore.sh, dotnet.sh) and standard system utilities (unzip, jq, sort, uniq) to facilitate the build and analysis process. These commands are integral to the intended profiling workflow and are executed within the user's local development environment.
  • Indirect Prompt Injection Surface: The skill processes external data from profiling traces.
  • Ingestion points: Data is read from traces/profile.json (referenced in SKILL.md).
  • Boundary markers: Explicit boundary markers or warnings for the content of the trace files are not present.
  • Capability inventory: The workflow employs unzip for extraction and jq, sort, and uniq for data processing (referenced in SKILL.md).
  • Sanitization: The skill relies on standard jq filtering without specific sanitization of the JSON content.
  • Context: This pattern is common in data analysis tools and is considered a standard part of the developer workflow for performance investigation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:27 AM
Security Audit — agent-trust-hub — startup-perf