The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The skill provides numerous commands (e.g., bun run bench:basic) that rely on the local environment's package.json. If an attacker provides a malicious package.json in the working directory, the agent will execute arbitrary code when attempting to run benchmarks.
[PROMPT_INJECTION] (HIGH): The skill is highly vulnerable to Indirect Prompt Injection (Category 8). It ingests untrusted external data via --manifest, --baseline, and --reference flags. Because the skill also possesses command execution (bun run) and file-write (--out) capabilities, maliciously crafted data in these ingested files could be used to manipulate the agent into performing unauthorized actions.
[DATA_EXFILTRATION] (LOW): While no direct network exfiltration is hardcoded, the ability to read arbitrary manifest and baseline files combined with command execution provides a mechanism for local data exposure.

performance-guardrails