golang-benchmark

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:32 PM UTC
• Version: 1.3.0

Overview

This Go performance skill is mostly coherent, but it includes copy-ready privileged tuning and insecure diagnostic examples that should be reviewed before use.

Review and constrain this skill before installing in shared or production-adjacent environments. Pin Go tool versions, avoid granting passwordless sudo to agents, run host-tuning commands only on disposable dedicated benchmark runners with rollback, and prefer localhost, SSH tunnels, VPNs, mTLS, and authenticated access for trace and pprof workflows. There was no artifact-backed evidence of deception, exfiltration, or malicious persistence.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Mutable @latest Go Tool Dependencies Permit Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-18, 32; references/benchstat.md:7-9; references/ci-regression.md:9-10, 45-46, 82-83
Vulnerability Type: Unpinned executable dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:

yaml

install:
  - kind: go
    package: golang.org/x/perf/cmd/benchstat@latest
    bins: [benchstat]

markdown

- benchstat: `go install golang.org/x/perf/cmd/benchstat@latest`

references/benchstat.md:

bash

go install golang.org/x/perf/cmd/benchstat@latest

references/ci-regression.md:

bash

go install filippo.io/mostly-harmless/benchdiff@latest

bash

go install github.com/knqyf263/cob@latest

bash

go install go.bobheadxi.dev/gobenchdata@latest

Technical Analysis

Each command resolves the mutable @latest version at installation time and compiles it into a locally executable binary. The effective code executed by the Skill can therefore change after the Skill package has been reviewed.

benchstat comes from an official Go module, but it is still not pinned to an immutable version. The CI regression tools are separate third-party projects and increase the supply-chain attack surface. A compromised upstream account, malicious release, or newly introduced dependency vulnerability could cause arbitrary code to run during installation or when the resulting binary is invoked.

Because these tools may run inside repository workspaces or CI jobs, they can inherit access to source code, build artifacts, environment variables, repository credentials, and any permissions granted to the CI job.

Attack Path

1. An upstream module, maintainer account, release process, or transitive dependency is compromised.
2. A malicious version becomes the version resolved by @latest.
3. An agent or CI workflow follows the Skill instructions and runs go install.
4. Go downloads and compiles the ch ...[truncated 788 chars]

Remediation

View remediation

Remediation Suggestions

• Replace every @latest reference with a reviewed, explicit version such as @vX.Y.Z.
• Maintain approved tool versions in a checked-in tool manifest or dedicated tools.go module.
• Record and verify module checksums through go.sum and the expected Go checksum database or an organization-controlled proxy.
• Upgrade tools through reviewed dependency-update pull requests rather than resolving mutable versions during Skill execution.
• Run third-party benchmark tools in isolated CI jobs with read-only repository access whenever possible.
• Grant CI tokens only the minimum required permissions and avoid exposing unrelated secrets to benchmark jobs.
• Consider prebuilding and signing approved tool binaries in a controlled build pipeline.

T09 · Insecure Skill Coding Practices

Error

• Location: references/trace.md:73

Finding

Execution Trace Web Interface Can Be Exposed Without Authentication

Content

View full analysis

Vulnerability Details

File Location: references/trace.md:73-78
Vulnerability Type: Unauthenticated diagnostic interface exposure
Risk Level: High

Vulnerable Code

bash

# Open on a specific port
go tool trace -http=:8080 trace.out

# Open on a specific host:port (e.g., for remote access)
go tool trace -http=0.0.0.0:8080 trace.out

Technical Analysis

Binding the trace viewer to 0.0.0.0:8080 makes the HTTP interface listen on every available network interface. The example provides no authentication, TLS, access-control, firewall, or tunneling requirement.

Execution traces may expose goroutine lifecycles, stack traces, package and function names, application architecture, timing information, runtime annotations, identifiers recorded through trace.Log, and operational behavior. The same reference documents endpoints such as /trace, /goroutines, and /goroutine/<id>, making the exposed data directly browsable.

This exceeds the minimum access required for local trace analysis. A loopback listener is sufficient for the declared profiling functionality in normal use.

Attack Path

1. An operator captures a trace containing production or otherwise sensitive diagnostic information.
2. The operator follows the remote-access example and starts the viewer on 0.0.0.0:8080.
3. The host firewall, container port mapping, cloud security group, or local network permits access to port 8080.
4. A network peer connects to the trace server without authentication.
5. The peer browses trace and goroutine endpoints and extracts internal application and runtime details.

Impact Assessment

An attacker who can reach the listening port can obtain unauthenticated read access to the loaded execution trace. This can reveal internal code structure, service behavior, timing patterns, goroutine details, operational metadata, and application-provided trace annotations.

The interface does not ...[truncated 179 chars]

Remediation

View remediation

Remediation Suggestions

• Replace wildcard bindings with an explicit loopback address:

  bash

  go tool trace -http=127.0.0.1:8080 trace.out
  

• For remote analysis, require an SSH tunnel, authenticated VPN, or authenticated TLS reverse proxy rather than direct network exposure.

• Add a prominent warning that trace data may contain sensitive stack traces, identifiers, annotations, and application topology.

• Require firewall rules that restrict access to a specific administrative source.

• Avoid placing the viewer behind publicly reachable container port mappings or cloud load balancers.

• Remove sensitive values from trace.Log annotations before capturing or sharing traces.

T09 · Insecure Skill Coding Practices

Error

• Location: references/pprof.md:651

Finding

pprof Guidance Permits TLS Certificate Verification Bypass

Content

View full analysis

Vulnerability Details

File Location: references/pprof.md:651-655
Vulnerability Type: Disabled TLS server authentication
Risk Level: High

Vulnerable Code

bash

# Fetch over TLS with client certificate
go tool pprof -tls_cert=client.crt -tls_key=client.key -tls_ca=ca.crt https://myservice:6060/debug/pprof/profile?seconds=30

# Fetch over TLS skipping server certificate verification
go tool pprof https+insecure://myservice:6060/debug/pprof/profile?seconds=30

Technical Analysis

The https+insecure form disables verification of the profiling server’s TLS certificate. Encryption without endpoint authentication does not protect against an active man-in-the-middle attacker.

Profiling data can reveal internal function names, package structure, call graphs, runtime labels, memory-allocation behavior, and service implementation details. An attacker able to intercept routing, DNS, or network traffic can impersonate the profiling endpoint and return manipulated data. This can both expose request activity and corrupt the operator’s diagnostic conclusions.

The preceding mutual-TLS example already supplies a secure mechanism, so the insecure fallback is not necessary for the Skill’s declared profiling functionality.

Attack Path

1. An operator uses the documented https+insecure URL to access a remote profiling endpoint.
2. An attacker gains a network interception position or influences DNS or routing.
3. The attacker presents an arbitrary certificate and impersonates myservice.
4. Because certificate verification is disabled, go tool pprof accepts the attacker-controlled endpoint.
5. The attacker observes profiling requests and supplies forged profile data.
6. The operator may disclose service access patterns or make performance changes based on manipulated diagnostics.

Impact Assessment

The primary impact is loss of profiling-channel integrity and server authenticity. A network ...[truncated 336 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the https+insecure example from the reference.
• Require normal certificate-chain and hostname verification for every remote profiling connection.
• Prefer the documented mutual-TLS form with a trusted CA, client certificate, and client key.
• If a private CA is used, install or explicitly reference that CA rather than disabling verification.
• Keep profiling endpoints on private administrative networks and apply authentication independently of TLS.
• Add guidance for protecting client private keys and ensuring restrictive file permissions.
• If an insecure connection is unavoidable during isolated testing, require explicit user confirmation and state that it must never be used across an untrusted network.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/ci-regression.md:225

Finding

Benchmark Tuning Instructions Perform Privileged System-Wide CPU Changes Without Restoration

Content

View full analysis

Vulnerability Details

File Location: references/ci-regression.md:225-281
Vulnerability Type: Excessive privileged host modification
Risk Level: Medium

Vulnerable Code

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

bash

# Intel
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

# AMD
echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

bash

# Disable SMT system-wide
echo off | sudo tee /sys/devices/system/cpu/smt/control

# Or disable individual sibling cores
echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online

bash

#!/bin/bash
# benchmark-setup.sh — run on self-hosted CI runner before benchmarks
set -euo pipefail

echo "=== Configuring CPU for stable benchmarks ==="
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true
echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

echo "=== Running benchmarks on isolated cores ==="
taskset -c 2,3 go test -bench=. -benchmem -count=10 ./... | tee bench.txt

Technical Analysis

These commands invoke sudo to modify Linux sysfs controls governing CPU frequency, turbo behavior, simultaneous multithreading, and CPU online state. The changes affect the entire host rather than only the benchmark process.

The reference appropriately warns that these commands must only be used on dedicated CI runners, which reduces accidental misuse. However, the combined script neither captures prior values nor restores them after completion or failure. The || true constructs also suppress failures, potentially leaving the host in a partially modified and difficult-to-diagnose state.

Host-wide privileged changes are broader than the permissions required for ord ...[truncated 1322 chars]

Remediation

View remediation

Remediation Suggestions

• Keep privileged host tuning outside the default Skill workflow and require explicit operator approval.
• Prefer dedicated benchmark hosts, process affinity, cgroup isolation, and workload scheduling over system-wide changes.
• Do not grant the agent unrestricted passwordless sudo. If automation is required, allowlist only narrowly defined helper commands.
• Capture every original sysfs value before modification.
• Install an EXIT, INT, and TERM trap that restores all original values on success, failure, or interruption.
• Validate CPU topology before taking any CPU offline; never assume cpu1 is a safe sibling.
• Remove || true where it can hide a partially applied configuration, or explicitly report and roll back partial failures.
• Run these operations only on ephemeral, single-purpose CI runners that can be destroyed after the benchmark.
• Document a tested restoration procedure and verify the final host configuration after every run.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · evals/evals.json (reported line 1311)May include surrounding context.

json

"name": "cost-warnings-trace-duration",
    "description": "Tests awareness of the cost and practical limits of execution traces",
    "prompt": "I want to capture a 5-minute execution trace of my Go service to analyze a periodic issue that happens every 2-3 minutes. Is this feasible?",
    "trap": "Without the skill, the model may agree to a 5-minute trace without warning about data volume",
    "assertions": [
      {
        "id": "49.1",

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/ci-regression.md (reported line 235)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/ci-regression.md (reported line 244)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/ci-regression.md (reported line 247)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/ci-regression.md (reported line 265)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/ci-regression.md (reported line 268)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/ci-regression.md (reported line 279)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/ci-regression.md (reported line 280)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/ci-regression.md (reported line 281)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The https+insecure:// example explicitly disables TLS certificate verification, which permits man-in-the-middle interception or spoofing of the profiled service. Because pprof data can contain highly sensitive operational details, demonstrating this insecure transport without a strong warning can normalize unsafe use in production troubleshooting workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This JSON file contains many natural-language "prompt" fields that appear to define when the skill should engage, but they are broad user utterances rather than a constrained trigger list. The file does not document activation boundaries, exclusions, or negative examples, which increases the risk of unintended invocation in adjacent Go performance conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document explicitly states that these tools should be run in CI only and not on local machines, but the tool selection table says benchdiff is best for 'Local dev + CI PR comparisons.' This conflicting natural-language guidance can cause users to ignore the stated safety constraint and run noisy or risky benchmark workflows locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document includes privileged system-tuning commands that change kernel and CPU behavior, including CPU governor, turbo settings, and SMT state. Even though the text warns to use them only on dedicated self-hosted CI runners, these commands can still cause host-wide availability, stability, and security-hardening regressions if copied into the wrong environment.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This command uses sudo to write to sysfs and change the CPU frequency governor system-wide. In a skill intended as reusable guidance, embedding root-level host modification increases the chance of unsafe copy/paste execution on developer machines or shared runners, affecting system integrity and availability.

Content

Scanner excerpt · references/ci-regression.md (reported line 235)May include surrounding context.

bash

# Set all CPUs to "performance" governor (fixed maximum frequency)
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Disable Turbo Boost

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This command uses elevated privileges to disable Intel Turbo Boost by writing to a kernel interface. That is a host-wide performance and power-management change that can degrade system behavior or violate operational expectations if run outside a tightly controlled benchmark host.

Content

Scanner excerpt · references/ci-regression.md (reported line 244)May include surrounding context.

bash

# Intel
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

# AMD
echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This AMD turbo/boost command similarly performs privileged host-wide tuning through sysfs. While intended for benchmark stability, it can alter system performance characteristics for all workloads and is unsafe as generic copy/paste guidance.

Content

Scanner excerpt · references/ci-regression.md (reported line 247)May include surrounding context.

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

AMD

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

text

### Pin benchmarks to specific CPU cores

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Disabling SMT system-wide via sudo changes CPU topology and can impact performance isolation, capacity, and security assumptions across the machine. Including such a command in a general-purpose skill materially raises operational risk if an agent or user applies it to the wrong host.

Content

Scanner excerpt · references/ci-regression.md (reported line 265)May include surrounding context.

bash

# Disable SMT system-wide
echo off | sudo tee /sys/devices/system/cpu/smt/control

# Or disable individual sibling cores (check /sys/devices/system/cpu/cpu*/topology/thread_siblings_list)
echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online  # if cpu0 and cpu1 are siblings

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Offlining a sibling CPU core requires elevated privileges and changes system CPU availability. Misuse can reduce service capacity or destabilize workloads on shared or production-adjacent hosts.

Content

Scanner excerpt · references/ci-regression.md (reported line 268)May include surrounding context.

echo off | sudo tee /sys/devices/system/cpu/smt/control

Or disable individual sibling cores (check /sys/devices/system/cpu/cpu*/topology/thread_siblings_list)

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

text

### Combined CI setup script

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The combined setup script includes sudo-based writes to sysfs and packages them into an easy-to-run automation snippet, which increases the likelihood of broad unsafe execution. Turning privileged host tuning into a ready-made script lowers friction for misuse compared with isolated conceptual examples.

Content

Scanner excerpt · references/ci-regression.md (reported line 279)May include surrounding context.

md

set -euo pipefail

echo "=== Configuring CPU for stable benchmarks ==="
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true
echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This line is part of the same privileged automation block and disables turbo using sudo in a scriptable form. In context, it contributes to a host-modifying sequence that is more dangerous than a standalone note because it is directly executable.

Content

Scanner excerpt · references/ci-regression.md (reported line 280)May include surrounding context.

md

echo "=== Configuring CPU for stable benchmarks ==="
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true
echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

echo "=== Running benchmarks on isolated cores ==="

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This scripted line disables SMT with sudo and is presented as part of a turnkey CI setup. Packaging multiple privileged system mutations together amplifies the risk of accidental host-wide changes and availability impact.

Content

Scanner excerpt · references/ci-regression.md (reported line 281)May include surrounding context.

md

echo "=== Configuring CPU for stable benchmarks ==="
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true
echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

echo "=== Running benchmarks on isolated cores ==="
taskset -c 2,3 go test -bench=. -benchmem -count=10 ./... | tee bench.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guide includes direct examples for fetching goroutine and heap profiles over HTTP endpoints that can expose stack traces, object layouts, request paths, labels, and other sensitive runtime details. Although the document briefly defers secure endpoint setup to another skill earlier, these specific examples lack an immediate warning at the point of use, increasing the chance readers will run them against exposed or insufficiently protected services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The programmatic tracing examples write runtime trace data directly to a local file without warning that traces can contain sensitive operational details such as request timing, goroutine activity, annotations, and potentially business identifiers logged through trace APIs. In a performance skill this is not malicious, but it can lead users to enable tracing in production or share trace artifacts insecurely, causing inadvertent data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented on-demand HTTP endpoint exposes flight recorder trace data to any caller unless protected externally, and the example shows no authentication, authorization, network restriction, or warning. Because traces can reveal internal execution details and application-level annotations, publishing such an endpoint in a production service can become a direct information disclosure vector.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.