ln-653-runtime-performance-auditor
https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/plugins/codebase-audit-suite/skills/ln-653-runtime-performance-auditor/SKILL.md
github.com/levnikolaevich/claude-code-skills
Scanned Thu, 28 May 2026 17:44:39 GMT
Scan ID crawl-rxj4dppbprvsbfkshg4ni4ws · 2ms
B
SCORE 75 / 100
Verdict: Safe to install

3 medium findings.

This skill spawns subprocesses outside its declared capabilities plus 2 other issues listed below.

0 critical0 high3 medium9 rules passed

Why grade B?

score · 75 / 100

The current grade reflects 3 medium findings (3+ MEDs → B).

0 CRIT0 HIGH3 MED0 LOW
To reach a higher grade
  • A
    Reach Atarget score 95

    Resolve 1 of 3 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 65CWE-78
▾
63 - File: `open(`, `.read_bytes()`, `.read_text()`, `.write_bytes()`, `.write_text()`, `Path(...).(read|write)`
64 - Network: `requests.get`, `requests.post`, `urllib.request`
65 - Subprocess: `subprocess.run(`, `subprocess.call(`← spawns a subprocess outside declared capabilities
66- Exclude: calls wrapped in `await asyncio.to_thread(...)` or `await loop.run_in_executor(...)`
67
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 69CWE-78
▾
67
68**Detection (Node.js):**
69- Inside `async function` or arrow async, grep for `fs.readFileSync`, `fs.writeFileSync`, `child_process.execSync`← spawns a subprocess outside declared capabilities
70
71**Severity:**
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-rxj4dppbprvsbfkshg4ni4ws