Compétences golang-benchmark

📦

golang-benchmark

Name: golang-benchmark
Author: samber

v1.3.2 Révision du contenu r1 Risque moyen ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement

Measure and Diagnose Go Performance

Go performance work often fails because benchmarks are noisy or profiles are misread. This skill provides a rigorous workflow for measurement, comparison, and diagnosis.

Prend en charge: Codex Code(CC)

⚠️ 50 Médiocre

Maintain this Skill? Claim it ⚠️ 50 Médiocre

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "golang-benchmark" from https://skillstore.io/skills/samber-golang-benchmark.md and its manifest at https://skillstore.io/api/skills/samber-golang-benchmark/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/samber-golang-benchmark.md manifest signé GET /api/skills/samber-golang-benchmark/manifest lockfile signé GET /api/skills/samber-golang-benchmark/lockfile

Tester

Utilisation de « golang-benchmark ». A candidate benchmark is three percent faster, but benchstat reports no significant difference.

Résultat attendu:

Do not claim an improvement. Increase sample quality, control environmental noise, and compare both versions under identical conditions.

Utilisation de « golang-benchmark ». A CPU profile is dominated by runtime allocation functions.

Résultat attendu:

Rank cumulative callers to find application entry points.
Inspect hot source lines and collect an allocation profile.
Confirm escape behavior before changing allocation strategy.

Utilisation de « golang-benchmark ». CI benchmarks vary by ten percent between runs.

Résultat attendu:

Use a dedicated runner, run benchmarks serially, increase repetitions, and set thresholds above measured environmental variance.

Audit de sécurité

Risque moyen

v1 • 23/09/2026 Ouvrir le rapport versionné

Most alerts are lexical false positives caused by Markdown, localhost examples, and profiling terminology. Confirmed risks include privileged CPU controls, token delegation, and an unauthenticated all-interface trace viewer. Semantic review also found insecure TLS guidance and an unpinned tool installation.

Fichiers analysés

5,264

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Moyen

references/pprof.md:704-705

TLS Verification Bypass

The reference recommends an https+insecure profiling URL, which disables server certificate verification and permits interception or impersonation.

The adjacent comment explicitly says server certificate verification is skipped, and the command uses the insecure scheme.

Moyen

SKILL.md:19 SKILL.md:32

Unpinned Tool Installation

The skill installs benchstat from a mutable latest version, reducing reproducibility and increasing exposure to an unexpected upstream release.

Both installation declarations explicitly use the mutable @latest selector rather than a fixed tool version.

Éléments d’évaluation des capacités (18)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

references/ci-regression.md:259

sudo privilege escalation

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

This command uses sudo to change the CPU governor for every core. It can alter host-wide performance and stability.

Élevé

references/ci-regression.md:268

sudo privilege escalation

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

This command uses sudo to disable Intel Turbo Boost through a kernel control. It changes host-wide CPU behavior.

Élevé

references/ci-regression.md:271

sudo privilege escalation

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

This command uses sudo to disable AMD boost through a kernel control. It changes host-wide CPU behavior.

Élevé

references/ci-regression.md:289

sudo privilege escalation

echo off | sudo tee /sys/devices/system/cpu/smt/control

This command uses sudo to disable SMT system-wide. It can reduce capacity and disrupt other workloads.

Élevé

references/ci-regression.md:292

sudo privilege escalation

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

This command uses sudo to take a CPU core offline. An incorrect core selection can disrupt the host.

Élevé

references/ci-regression.md:303

sudo privilege escalation

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The setup script uses sudo to change every CPU governor. Running it modifies the entire host, not only the benchmark process.

Élevé

references/ci-regression.md:304

sudo privilege escalation

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true

The setup script uses sudo to disable Turbo Boost. Error suppression can hide an unsupported or failed system modification.

Élevé

references/ci-regression.md:305

sudo privilege escalation

echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

The setup script uses sudo to disable SMT. Error suppression can hide a failed host-wide configuration change.

Élevé

references/ci-regression.md:259

Linux /sys filesystem access

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The command writes to a /sys CPU governor control for all cores. This is a privileged host-wide configuration change.

Élevé

references/ci-regression.md:268

Linux /sys filesystem access

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

The command writes to the Intel pstate no_turbo control in /sys. This changes host-wide CPU behavior.

Élevé

references/ci-regression.md:271

Linux /sys filesystem access

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

The command writes to the AMD boost control in /sys. This changes host-wide CPU behavior.

Élevé

references/ci-regression.md:289

Linux /sys filesystem access

echo off | sudo tee /sys/devices/system/cpu/smt/control

The command writes to the SMT control in /sys. This disables simultaneous multithreading across the host.

Élevé

references/ci-regression.md:292

Linux /sys filesystem access

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

The command writes to a CPU online control in /sys. It can remove a processor from service.

Élevé

references/ci-regression.md:303

Linux /sys filesystem access

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The script writes a performance governor to every matching /sys CPU control. This is a privileged host-wide change.

Élevé

references/ci-regression.md:304

Linux /sys filesystem access

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true

The script writes to the Intel pstate no_turbo control in /sys. It suppresses errors from the system modification.

Élevé

references/ci-regression.md:305

Linux /sys filesystem access

echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

The script writes to the SMT control in /sys. It suppresses errors from the host-wide system modification.

Élevé

references/ci-regression.md:162

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow passes GITHUB_TOKEN to a third-party action that publishes content. A compromised action could misuse repository permissions.

Élevé

references/trace.md:115

Hardcoded IP address

go tool trace -http=0.0.0.0:8080 trace.out

Binding the trace viewer to 0.0.0.0 exposes diagnostic data on every network interface. The example provides no authentication control.

Facteurs de risque

⚙️ Commandes externes (50)

evals/evals.json:6 evals/evals.json:7 evals/evals.json:24 evals/evals.json:32 evals/evals.json:58-86 evals/evals.json:86 evals/evals.json:115-157 evals/evals.json:157-202 evals/evals.json:202-207 evals/evals.json:207-219 evals/evals.json:219 evals/evals.json:236-240 evals/evals.json:240-265 evals/evals.json:265-292 evals/evals.json:292-312 evals/evals.json:312 evals/evals.json:445-450 evals/evals.json:450-704 evals/evals.json:704-729 evals/evals.json:729-775 evals/evals.json:775-804 evals/evals.json:804 evals/evals.json:805 evals/evals.json:809-821 evals/evals.json:821-1000 evals/evals.json:1000 evals/evals.json:1019-1080 evals/evals.json:1080 evals/evals.json:1093 evals/evals.json:1385 evals/evals.json:1484 evals/evals.json:1489-1497 evals/evals.json:1497 evals/evals.json:1542-1655 evals/evals.json:1655 evals/evals.json:1742 evals/evals.json:1767 evals/evals.json:1846 references/benchstat.md:377 references/ci-regression.md:120 references/ci-regression.md:298 references/ci-regression.md:259 references/ci-regression.md:268 references/ci-regression.md:271 references/ci-regression.md:289 references/ci-regression.md:292 references/ci-regression.md:303 references/ci-regression.md:304 references/ci-regression.md:305 SKILL.md:3

🌐 Accès réseau (27)

📁 Accès au système de fichiers (18)

🔑 Variables d’environnement (1)

references/ci-regression.md:162

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/samber-golang-benchmark/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-benchmark/security.svg)](https://skillstore.io/skills/samber-golang-benchmark?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/samber-golang-benchmark?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-benchmark/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/samber-golang-benchmark.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

samber. (2026). golang-benchmark security audit report (audit version 1) [Author version 1.3.2]. Skillstore. https://skillstore.io/skills/samber-golang-benchmark/audits/1

Citation BibTeX

@techreport{samber-samber-golang-benchmark-2026,
  author = {samber},
  title = {golang-benchmark security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-benchmark/audits/1},
  note = {Author version 1.3.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-benchmark security audit report (audit version 1)"
version: "1.3.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-benchmark/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-benchmark:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Validate an Optimization

Create repeatable before-and-after benchmarks and decide whether measured changes are statistically significant.

Diagnose Production Latency

Correlate runtime metrics with CPU, memory, goroutine, and trace evidence to identify expensive paths.

Prevent CI Regressions

Establish benchmark baselines, practical thresholds, and controlled runner settings for pull request checks.

Essayez ces prompts

Write a Benchmark

Write a Go benchmark for [function]. Exclude setup time, report allocations, and use representative inputs.

Compare Two Results

Compare these baseline and candidate benchmark results. Explain significance, noise, allocation changes, and whether the optimization is supported.

Investigate a Profile

Analyze this [CPU or memory] profile summary. Identify likely application callers and recommend focused pprof commands for confirmation.

Design a Regression Gate

Design a CI benchmark gate for [repository]. Include baseline handling, sample counts, thresholds, runner controls, permissions, and failure investigation.

Bonnes pratiques

Compare versions on the same toolchain, hardware, workload, and runner configuration.
Collect multiple samples and use statistical results before making performance claims.
Preserve benchmark context, profile type, build identity, and hardware details with every result.

Éviter

Do not approve an optimization from one benchmark run or a nonsignificant result.
Do not run competing benchmarks concurrently on shared processors.
Do not expose profiling or trace endpoints without authentication and network restrictions.