startup-perf
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill utilizes local shell scripts (
restore.sh,dotnet.sh) and standard system utilities (unzip,jq,sort,uniq) to facilitate the build and analysis process. These commands are integral to the intended profiling workflow and are executed within the user's local development environment. - Indirect Prompt Injection Surface: The skill processes external data from profiling traces.
- Ingestion points: Data is read from
traces/profile.json(referenced inSKILL.md). - Boundary markers: Explicit boundary markers or warnings for the content of the trace files are not present.
- Capability inventory: The workflow employs
unzipfor extraction andjq,sort, anduniqfor data processing (referenced inSKILL.md). - Sanitization: The skill relies on standard
jqfiltering without specific sanitization of the JSON content. - Context: This pattern is common in data analysis tools and is considered a standard part of the developer workflow for performance investigation.
Audit Metadata