Performance Engineering System

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:24 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its performance-engineering purpose, but it includes copyable examples that can run unpinned external tools and expose profiling diagnostics without enough safety guidance.

Review this skill before installing or following commands. Use pinned or locally locked tool versions, avoid running `npx` downloads in sensitive projects, bind profiling servers to loopback with access controls, and run load tests only against systems you own or are authorized to test, preferably staging.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:109

Finding

Unpinned Third-Party Packages Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 109-114; additional instances at lines 599-600
Vulnerability Type: Supply-chain exposure through unpinned package execution
Risk Level: Medium

Vulnerable Code

bash

# Clinic.js (best overall Node.js profiler)
npx clinic doctor -- node app.js
npx clinic flame -- node app.js    # Flame graph
npx clinic bubbleprof -- node app.js  # Async bottlenecks

# 0x (flame graphs)
npx 0x app.js

Additional affected commands:

text

- Webpack: npx webpack-bundle-analyzer stats.json
- Vite: npx vite-bundle-visualizer

Technical Analysis

The Skill recommends invoking third-party packages through npx without pinning package versions or requiring that the packages already be installed from a reviewed lockfile. If a requested package is not present locally, npx may retrieve it from the configured package registry and immediately execute its code.

This creates a supply-chain trust boundary that is unnecessary for the Skill's underlying performance-analysis methodology. The effective executable code can change after the Skill has been reviewed. A compromised publisher account, malicious package release, registry compromise, dependency compromise, package-name error, or unsafe registry configuration could cause attacker-controlled code to execute.

Package installation and execution may also trigger lifecycle scripts. Such code runs with the permissions of the user invoking npx and can generally access the current project, writable files, process environment, developer credentials available to the process, and network resources accessible from the host.

Attack Path

1. A user follows the profiling or bundle-analysis instructions from the Skill.
2. The named package is not already available in the local project.
3. npx resolves the package through the user's configured package registry.
4. The registry supplies a compromised, mal ...[truncated 1009 chars]

Remediation

View remediation

Remediation Suggestions

1. Add required tools as reviewed development dependencies using exact versions and commit the package-manager lockfile.
2. Execute only the locked local package binaries. Where supported, use npx --no-install so execution fails rather than downloading an absent package.
3. Avoid floating versions and do not rely on the registry's current default or latest release.
4. Review dependency provenance, maintainers, transitive dependencies, lifecycle scripts, and published integrity metadata before adoption.
5. Use a trusted registry or approved internal mirror with package allowlisting and integrity verification.
6. Run profiling tools in an isolated, least-privileged environment without production credentials or unnecessary network access.
7. Update the Skill text to warn users that npx may download and execute remote package code.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:151

Finding

Go pprof Diagnostic Server Listens on All Network Interfaces Without Access Control

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 151-160
Vulnerability Type: Unauthenticated diagnostic endpoint exposed on a wildcard network listener
Risk Level: Medium

Vulnerable Code

go

// Built-in pprof
import (
    "net/http"
    _ "net/http/pprof"
    "runtime/pprof"
)

// HTTP server (add to existing server)
// Access: http://localhost:6060/debug/pprof/
go func() { http.ListenAndServe(":6060", nil) }()

// CLI analysis
// go tool pprof http://localhost:6060/debug/pprof/profile?seconds=30

Technical Analysis

Passing :6060 to http.ListenAndServe creates a wildcard listener rather than restricting the service to the loopback interface. Although the comment describes access through localhost, the actual configuration may make the diagnostic server reachable through every host interface permitted by the operating system and network controls.

The blank import of net/http/pprof registers profiling handlers on the default HTTP multiplexer. No authentication, authorization, transport protection, request filtering, deployment guard, or network restriction is included. Diagnostic handlers can disclose detailed process behavior and runtime metadata. Some profiling operations also deliberately collect data over time and consume CPU or other resources.

The example also discards the error returned by ListenAndServe, reducing operational visibility. In addition, as presented, the runtime/pprof import is unused and would need removal or actual use before the example compiles; this does not mitigate the unsafe listener pattern if the example is adapted.

Attack Path

1. A developer copies the example into an application and enables it in a shared, staging, or production environment.
2. The application opens TCP port 6060 on all available interfaces.
3. Firewall, container, Kubernetes, or cloud-network configuration makes that port reachable by an unauthorized party.

...[truncated 1132 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind local diagnostics explicitly to loopback, for example 127.0.0.1:6060, rather than using :6060.
2. Use a dedicated http.ServeMux instead of registering diagnostic handlers on the application's default multiplexer.
3. Enable pprof only through an explicit development or diagnostic configuration flag, with production disabled by default.
4. If remote profiling is required, place the endpoint behind strong authentication and authorization, encrypted transport, firewall restrictions, and an administrative network or authenticated tunnel.
5. Do not expose the profiling port through public load balancers, container port mappings, ingress resources, or unrestricted security groups.
6. Apply request timeouts, concurrency limits, rate limits, monitoring, and audit logging to diagnostic access.
7. Handle and log the error returned by ListenAndServe.
8. Remove the unused runtime/pprof import unless the example actually uses it, and provide a complete, compilable hardened example.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The quick-start examples use very generic natural-language trigger phrases such as 'Why is this endpoint slow?' and 'Load test the API,' which are likely to appear in ordinary conversation. In systems that auto-activate skills based on prompt matching, this can cause unintended invocation of the performance-engineering skill, leading to context hijacking, misrouting, or unexpected operational guidance being applied when the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx clinic doctor -- node app.js without pinning an exact package version allows execution of whatever version npx resolves at runtime. In a skill that may be followed verbatim, this creates a supply-chain risk: a malicious or compromised package release could execute arbitrary code on the analyst or developer machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx clinic flame -- node app.js without a pinned version has the same supply-chain exposure as other unpinned npx invocations. A user following the skill could unknowingly run a newly published or compromised package version with local code execution privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx clinic bubbleprof -- node app.js without version pinning permits dynamic retrieval and execution of an external package version at runtime. Because these commands are operational instructions, the risk is practical rather than theoretical if copied into a shell.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 523)May include surrounding context.

md

};

export default function () {
  const res = http.get('https://api.example.com/endpoint');

  check(res, {
    'status 200': (r) => r.status === 200,

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

npx webpack-bundle-analyzer without version pinning can fetch and execute an unexpected package version from the registry. In a developer-focused skill, that exposes users to avoidable supply-chain compromise if the package or dependency tree is tampered with.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

npx vite-bundle-visualizer without a pinned version also enables runtime execution of unreviewed package contents. The skill context increases risk because users may copy and run the command exactly as written during troubleshooting.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language triggers are extremely broad phrases like 'Load test the API' and 'Find the bottleneck', which can overlap with ordinary user requests and cause this skill to activate unexpectedly. In an agent setting, over-broad triggers can route unrelated conversations into workflows that recommend running profiling, load-testing, or external tooling commands on real systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.