golang-benchmark
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides detailed instructions for executing Golang performance measurement commands, including running benchmarks (
go test -bench), generating profiles (go tool pprof,go tool trace), and performing statistical comparisons (benchstat). It also includes specific commands for system-level tuning on dedicated CI runners (e.g., setting CPU governors and disabling Turbo Boost) usingsudo, which are accompanied by clear safety warnings and intended for specialized environments. - [EXTERNAL_DOWNLOADS]: Directs the user to install several reputable Golang performance utilities from external repositories. These include
benchstatfromgolang.org(Google-managed),benchdifffromfilippo.io(Filippo Valsorda),cobfromgithub.com/knqyf263, andgobenchdatafromgo.bobheadxi.dev. These sources are recognized as standard within the Go development community. - [DATA_EXFILTRATION]: Mentions the use of
curlto capture diagnostic trace and profile data from local endpoints (e.g.,localhost:6060/debug/pprof/trace). This is a standard procedure for local application diagnostics and does not involve unauthorized remote data transmission. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection by instructing the agent to process data from external sources.
- Ingestion points: Reads and analyzes benchmark results from local files (e.g.,
old.txt,new.txt,bench.txt) as described inSKILL.mdandreferences/benchstat.md. - Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' commands when processing benchmark output.
- Capability inventory: The skill possesses the capability to execute a variety of command-line tools via
Bashacross multiple scripts. - Sanitization: Absent; benchmark results are interpreted as raw text without automated validation or sanitization routines.
Audit Metadata