Performance Engineering System

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:24 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its performance-engineering purpose, but it includes copyable examples that can run unpinned external tools and expose profiling diagnostics without enough safety guidance.

Review this skill before installing or following commands. Use pinned or locally locked tool versions, avoid running `npx` downloads in sensitive projects, bind profiling servers to loopback with access controls, and run load tests only against systems you own or are authorized to test, preferably staging.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:109
• Finding: Unpinned Third-Party Packages Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 109-114; additional instances at lines 599-600 **Vulnerability Type**: Supply-chain exposure through unpinned package execution **Risk Level**: Medium ### Vulnerable Code ```bash # Clinic.js (best overall Node.js profiler) npx clinic doctor -- node app.js npx clinic flame -- node app.js # Flame graph npx clinic bubbleprof -- node app.js # Async bottlenecks # 0x (flame graphs) npx 0x app.js ``` Additional affected commands: ```text - Webpack: npx webpack-bundle-analyzer stats.json - Vite: npx vite-bundle-visualizer ``` ### Technical Analysis The Skill recommends invoking third-party packages through `npx` without pinning package versions or requiring that the packages already be installed from a reviewed lockfile. If a requested package is not present locally, `npx` may retrieve it from the configured package registry and immediately execute its code. This creates a supply-chain trust boundary that is unnecessary for the Skill's underlying performance-analysis methodology. The effective executable code can change after the Skill has been reviewed. A compromised publisher account, malicious package release, registry compromise, dependency compromise, package-name error, or unsafe registry configuration could cause attacker-controlled code to execute. Package installation and execution may also trigger lifecycle scripts. Such code runs with the permissions of the user invoking `npx` and can generally access the current project, writable files, process environment, developer credentials available to the process, and network resources accessible from the host. ### Attack Path 1. A user follows the profiling or bundle-analysis instructions from the Skill. 2. The named package is not already available in the local project. 3. `npx` resolves the package through the user's configured package registry. 4. The registry supplies a compromised, mal ...[truncated 1009 chars]
• Remediation: ## Remediation Suggestions 1. Add required tools as reviewed development dependencies using exact versions and commit the package-manager lockfile. 2. Execute only the locked local package binaries. Where supported, use `npx --no-install` so execution fails rather than downloading an absent package. 3. Avoid floating versions and do not rely on the registry's current default or latest release. 4. Review dependency provenance, maintainers, transitive dependencies, lifecycle scripts, and published integrity metadata before adoption. 5. Use a trusted registry or approved internal mirror with package allowlisting and integrity verification. 6. Run profiling tools in an isolated, least-privileged environment without production credentials or unnecessary network access. 7. Update the Skill text to warn users that `npx` may download and execute remote package code.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:151
• Finding: Go pprof Diagnostic Server Listens on All Network Interfaces Without Access Control## Vulnerability Details **File Location**: `SKILL.md`, lines 151-160 **Vulnerability Type**: Unauthenticated diagnostic endpoint exposed on a wildcard network listener **Risk Level**: Medium ### Vulnerable Code ```go // Built-in pprof import ( "net/http" _ "net/http/pprof" "runtime/pprof" ) // HTTP server (add to existing server) // Access: http://localhost:6060/debug/pprof/ go func() { http.ListenAndServe(":6060", nil) }() // CLI analysis // go tool pprof http://localhost:6060/debug/pprof/profile?seconds=30 ``` ### Technical Analysis Passing `:6060` to `http.ListenAndServe` creates a wildcard listener rather than restricting the service to the loopback interface. Although the comment describes access through `localhost`, the actual configuration may make the diagnostic server reachable through every host interface permitted by the operating system and network controls. The blank import of `net/http/pprof` registers profiling handlers on the default HTTP multiplexer. No authentication, authorization, transport protection, request filtering, deployment guard, or network restriction is included. Diagnostic handlers can disclose detailed process behavior and runtime metadata. Some profiling operations also deliberately collect data over time and consume CPU or other resources. The example also discards the error returned by `ListenAndServe`, reducing operational visibility. In addition, as presented, the `runtime/pprof` import is unused and would need removal or actual use before the example compiles; this does not mitigate the unsafe listener pattern if the example is adapted. ### Attack Path 1. A developer copies the example into an application and enables it in a shared, staging, or production environment. 2. The application opens TCP port 6060 on all available interfaces. 3. Firewall, container, Kubernetes, or cloud-network configuration makes that port reachable by an unauthorized party. ...[truncated 1132 chars]
• Remediation: ## Remediation Suggestions 1. Bind local diagnostics explicitly to loopback, for example `127.0.0.1:6060`, rather than using `:6060`. 2. Use a dedicated `http.ServeMux` instead of registering diagnostic handlers on the application's default multiplexer. 3. Enable pprof only through an explicit development or diagnostic configuration flag, with production disabled by default. 4. If remote profiling is required, place the endpoint behind strong authentication and authorization, encrypted transport, firewall restrictions, and an administrative network or authenticated tunnel. 5. Do not expose the profiling port through public load balancers, container port mappings, ingress resources, or unrestricted security groups. 6. Apply request timeouts, concurrency limits, rate limits, monitoring, and audit logging to diagnostic access. 7. Handle and log the error returned by `ListenAndServe`. 8. Remove the unused `runtime/pprof` import unless the example actually uses it, and provide a complete, compilable hardened example.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The quick-start examples use very generic natural-language trigger phrases such as 'Why is this endpoint slow?' and 'Load test the API,' which are likely to appear in ordinary conversation. In systems that auto-activate skills based on prompt matching, this can cause unintended invocation of the performance-engineering skill, leading to context hijacking, misrouting, or unexpected operational guidance being applied when the user did not explicitly request this skill.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: Using `npx clinic doctor -- node app.js` without pinning an exact package version allows execution of whatever version `npx` resolves at runtime. In a skill that may be followed verbatim, this creates a supply-chain risk: a malicious or compromised package release could execute arbitrary code on the analyst or developer machine.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: Using `npx clinic flame -- node app.js` without a pinned version has the same supply-chain exposure as other unpinned `npx` invocations. A user following the skill could unknowingly run a newly published or compromised package version with local code execution privileges.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: Using `npx clinic bubbleprof -- node app.js` without version pinning permits dynamic retrieval and execution of an external package version at runtime. Because these commands are operational instructions, the risk is practical rather than theoretical if copied into a shell.

External Transmission

Medium

• Category: Data Exfiltration

Content

};

export default function () {
  const res = http.get('https://api.example.com/endpoint');

  check(res, {
    'status 200': (r) => r.status === 200,

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: `npx webpack-bundle-analyzer` without version pinning can fetch and execute an unexpected package version from the registry. In a developer-focused skill, that exposes users to avoidable supply-chain compromise if the package or dependency tree is tampered with.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: `npx vite-bundle-visualizer` without a pinned version also enables runtime execution of unreviewed package contents. The skill context increases risk because users may copy and run the command exactly as written during troubleshooting.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The natural-language triggers are extremely broad phrases like 'Load test the API' and 'Find the bottleneck', which can overlap with ordinary user requests and cause this skill to activate unexpectedly. In an agent setting, over-broad triggers can route unrelated conversations into workflows that recommend running profiling, load-testing, or external tooling commands on real systems.

Static analysis

No suspicious patterns detected.