skills/tkersey/dotfiles/lift/Gen Agent Trust Hub

lift

Pass

Audited by Gen Agent Trust Hub on Mar 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads source code from the author's repository at https://github.com/tkersey/skills-zig and installs packages via the tkersey/tap/lift Homebrew tap. These resources are vendor-controlled and used to set up the benchmarking environment.
  • [COMMAND_EXECUTION]: The skill performs command-line operations to build and execute its performance tools. This includes git clone to fetch source, zig build to compile the tools locally, and direct execution of the bench_stats and perf_report binaries to gather metrics.
  • [PROMPT_INJECTION]: The skill identifies as an indirect prompt injection surface as it is designed to execute external workloads for benchmarking purposes.
  • Ingestion points: The skill reads and runs user-provided reproduction scripts and workload commands as described in SKILL.md.
  • Boundary markers: No explicit markers or delimiters are used to isolate the workload commands during execution.
  • Capability inventory: The skill executes shell commands and compiled binaries with access to the local filesystem for report generation.
  • Sanitization: As a performance tool, it executes workloads directly to capture realistic metrics and does not perform content validation on the input scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 2, 2026, 08:47 AM