Security Audit
application-performance-performance-optimization
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
application-performance-performance-optimization received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Potential Prompt Injection via $ARGUMENTS in subagent prompts.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential Prompt Injection via $ARGUMENTS in subagent prompts The skill constructs prompts for various subagents by directly embedding the `$ARGUMENTS` placeholder. If `$ARGUMENTS` contains untrusted user input, a malicious actor could attempt to inject instructions into the subagent's prompt, potentially altering its intended behavior, causing unintended actions, or escalating privileges if the subagent has broad capabilities. This is a common prompt injection vector in LLM-based systems where user input is directly interpolated into agent instructions without explicit sanitization or instruction guarding. Implement robust input sanitization and validation for `$ARGUMENTS` before it is interpolated into subagent prompts. Consider using structured input formats or prompt templating engines that strictly separate user input from instructions. The orchestrating LLM should be explicitly instructed to guard against prompt injection when filling `$ARGUMENTS` to prevent malicious instructions from being passed to subagents. | LLM | SKILL.md:59 |
Scan History
Embed Code
[](https://skillshield.io/report/b296b2b24fc56e8a)
Powered by SkillShield