スキル golang-benchmark

📦

golang-benchmark

Name: golang-benchmark
Author: samber

v1.3.2 コンテンツリビジョン r1 中リスク ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数

Measure and Diagnose Go Performance

Go performance work often fails because benchmarks are noisy or profiles are misread. This skill provides a rigorous workflow for measurement, comparison, and diagnosis.

対応: Codex Code(CC)

⚠️ 50 不十分

Maintain this Skill? Claim it ⚠️ 50 不十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "golang-benchmark" from https://skillstore.io/skills/samber-golang-benchmark.md and its manifest at https://skillstore.io/api/skills/samber-golang-benchmark/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/samber-golang-benchmark.md 署名済み manifest GET /api/skills/samber-golang-benchmark/manifest 署名済み lockfile GET /api/skills/samber-golang-benchmark/lockfile

テストする

「golang-benchmark」を使用しています。 A candidate benchmark is three percent faster, but benchstat reports no significant difference.

期待される結果:

Do not claim an improvement. Increase sample quality, control environmental noise, and compare both versions under identical conditions.

「golang-benchmark」を使用しています。 A CPU profile is dominated by runtime allocation functions.

期待される結果:

Rank cumulative callers to find application entry points.
Inspect hot source lines and collect an allocation profile.
Confirm escape behavior before changing allocation strategy.

「golang-benchmark」を使用しています。 CI benchmarks vary by ten percent between runs.

期待される結果:

Use a dedicated runner, run benchmarks serially, increase repetitions, and set thresholds above measured environmental variance.

セキュリティ監査

中リスク

v1 • 2026/9/23 バージョン別レポートを開く

Most alerts are lexical false positives caused by Markdown, localhost examples, and profiling terminology. Confirmed risks include privileged CPU controls, token delegation, and an unauthenticated all-interface trace viewer. Semantic review also found insecure TLS guidance and an unpinned tool installation.

スキャンされたファイル

5,264

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (2)

中

references/pprof.md:704-705

TLS Verification Bypass

The reference recommends an https+insecure profiling URL, which disables server certificate verification and permits interception or impersonation.

The adjacent comment explicitly says server certificate verification is skipped, and the command uses the insecure scheme.

中

SKILL.md:19 SKILL.md:32

Unpinned Tool Installation

The skill installs benchstat from a mutable latest version, reducing reproducibility and increasing exposure to an unexpected upstream release.

Both installation declarations explicitly use the mutable @latest selector rather than a fixed tool version.

機能レビュー項目 (18)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

references/ci-regression.md:259

sudo privilege escalation

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

This command uses sudo to change the CPU governor for every core. It can alter host-wide performance and stability.

高

references/ci-regression.md:268

sudo privilege escalation

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

This command uses sudo to disable Intel Turbo Boost through a kernel control. It changes host-wide CPU behavior.

高

references/ci-regression.md:271

sudo privilege escalation

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

This command uses sudo to disable AMD boost through a kernel control. It changes host-wide CPU behavior.

高

references/ci-regression.md:289

sudo privilege escalation

echo off | sudo tee /sys/devices/system/cpu/smt/control

This command uses sudo to disable SMT system-wide. It can reduce capacity and disrupt other workloads.

高

references/ci-regression.md:292

sudo privilege escalation

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

This command uses sudo to take a CPU core offline. An incorrect core selection can disrupt the host.

高

references/ci-regression.md:303

sudo privilege escalation

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The setup script uses sudo to change every CPU governor. Running it modifies the entire host, not only the benchmark process.

高

references/ci-regression.md:304

sudo privilege escalation

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true

The setup script uses sudo to disable Turbo Boost. Error suppression can hide an unsupported or failed system modification.

高

references/ci-regression.md:305

sudo privilege escalation

echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

The setup script uses sudo to disable SMT. Error suppression can hide a failed host-wide configuration change.

高

references/ci-regression.md:259

Linux /sys filesystem access

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The command writes to a /sys CPU governor control for all cores. This is a privileged host-wide configuration change.

高

references/ci-regression.md:268

Linux /sys filesystem access

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

The command writes to the Intel pstate no_turbo control in /sys. This changes host-wide CPU behavior.

高

references/ci-regression.md:271

Linux /sys filesystem access

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

The command writes to the AMD boost control in /sys. This changes host-wide CPU behavior.

高

references/ci-regression.md:289

Linux /sys filesystem access

echo off | sudo tee /sys/devices/system/cpu/smt/control

The command writes to the SMT control in /sys. This disables simultaneous multithreading across the host.

高

references/ci-regression.md:292

Linux /sys filesystem access

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

The command writes to a CPU online control in /sys. It can remove a processor from service.

高

references/ci-regression.md:303

Linux /sys filesystem access

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The script writes a performance governor to every matching /sys CPU control. This is a privileged host-wide change.

高

references/ci-regression.md:304

Linux /sys filesystem access

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true

The script writes to the Intel pstate no_turbo control in /sys. It suppresses errors from the system modification.

高

references/ci-regression.md:305

Linux /sys filesystem access

echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

The script writes to the SMT control in /sys. It suppresses errors from the host-wide system modification.

高

references/ci-regression.md:162

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow passes GITHUB_TOKEN to a third-party action that publishes content. A compromised action could misuse repository permissions.

高

references/trace.md:115

Hardcoded IP address

go tool trace -http=0.0.0.0:8080 trace.out

Binding the trace viewer to 0.0.0.0 exposes diagnostic data on every network interface. The example provides no authentication control.

リスク要因

⚙️ 外部コマンド (50)

evals/evals.json:6 evals/evals.json:7 evals/evals.json:24 evals/evals.json:32 evals/evals.json:58-86 evals/evals.json:86 evals/evals.json:115-157 evals/evals.json:157-202 evals/evals.json:202-207 evals/evals.json:207-219 evals/evals.json:219 evals/evals.json:236-240 evals/evals.json:240-265 evals/evals.json:265-292 evals/evals.json:292-312 evals/evals.json:312 evals/evals.json:445-450 evals/evals.json:450-704 evals/evals.json:704-729 evals/evals.json:729-775 evals/evals.json:775-804 evals/evals.json:804 evals/evals.json:805 evals/evals.json:809-821 evals/evals.json:821-1000 evals/evals.json:1000 evals/evals.json:1019-1080 evals/evals.json:1080 evals/evals.json:1093 evals/evals.json:1385 evals/evals.json:1484 evals/evals.json:1489-1497 evals/evals.json:1497 evals/evals.json:1542-1655 evals/evals.json:1655 evals/evals.json:1742 evals/evals.json:1767 evals/evals.json:1846 references/benchstat.md:377 references/ci-regression.md:120 references/ci-regression.md:298 references/ci-regression.md:259 references/ci-regression.md:268 references/ci-regression.md:271 references/ci-regression.md:289 references/ci-regression.md:292 references/ci-regression.md:303 references/ci-regression.md:304 references/ci-regression.md:305 SKILL.md:3

🌐 ネットワークアクセス (27)

📁 ファイルシステムへのアクセス (18)

🔑 環境変数 (1)

references/ci-regression.md:162

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/samber-golang-benchmark/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-benchmark/security.svg)](https://skillstore.io/skills/samber-golang-benchmark?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/samber-golang-benchmark?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-benchmark/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/samber-golang-benchmark.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

samber. (2026). golang-benchmark security audit report (audit version 1) [Author version 1.3.2]. Skillstore. https://skillstore.io/skills/samber-golang-benchmark/audits/1

BibTeX形式の引用

@techreport{samber-samber-golang-benchmark-2026,
  author = {samber},
  title = {golang-benchmark security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-benchmark/audits/1},
  note = {Author version 1.3.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-benchmark security audit report (audit version 1)"
version: "1.3.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-benchmark/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-benchmark:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

100

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Validate an Optimization

Create repeatable before-and-after benchmarks and decide whether measured changes are statistically significant.

Diagnose Production Latency

Correlate runtime metrics with CPU, memory, goroutine, and trace evidence to identify expensive paths.

Prevent CI Regressions

Establish benchmark baselines, practical thresholds, and controlled runner settings for pull request checks.

これらのプロンプトを試す

Write a Benchmark

Write a Go benchmark for [function]. Exclude setup time, report allocations, and use representative inputs.

Compare Two Results

Compare these baseline and candidate benchmark results. Explain significance, noise, allocation changes, and whether the optimization is supported.

Investigate a Profile

Analyze this [CPU or memory] profile summary. Identify likely application callers and recommend focused pprof commands for confirmation.

Design a Regression Gate

Design a CI benchmark gate for [repository]. Include baseline handling, sample counts, thresholds, runner controls, permissions, and failure investigation.

ベストプラクティス

Compare versions on the same toolchain, hardware, workload, and runner configuration.
Collect multiple samples and use statistical results before making performance claims.
Preserve benchmark context, profile type, build identity, and hardware details with every result.

回避

Do not approve an optimization from one benchmark run or a nonsignificant result.
Do not run competing benchmarks concurrently on shared processors.
Do not expose profiling or trace endpoints without authentication and network restrictions.