技能 golang-benchmark

📦

golang-benchmark

Name: golang-benchmark
Author: samber

v1.3.2 內容修訂 r1 中風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

Measure and Diagnose Go Performance

Go performance work often fails because benchmarks are noisy or profiles are misread. This skill provides a rigorous workflow for measurement, comparison, and diagnosis.

支援: Codex Code(CC)

⚠️ 50 差

Maintain this Skill? Claim it ⚠️ 50 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "golang-benchmark" from https://skillstore.io/skills/samber-golang-benchmark.md and its manifest at https://skillstore.io/api/skills/samber-golang-benchmark/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/samber-golang-benchmark.md 已簽名 manifest GET /api/skills/samber-golang-benchmark/manifest 已簽名 lockfile GET /api/skills/samber-golang-benchmark/lockfile

測試它

正在使用「golang-benchmark」。 A candidate benchmark is three percent faster, but benchstat reports no significant difference.

預期結果:

Do not claim an improvement. Increase sample quality, control environmental noise, and compare both versions under identical conditions.

正在使用「golang-benchmark」。 A CPU profile is dominated by runtime allocation functions.

預期結果:

Rank cumulative callers to find application entry points.
Inspect hot source lines and collect an allocation profile.
Confirm escape behavior before changing allocation strategy.

正在使用「golang-benchmark」。 CI benchmarks vary by ten percent between runs.

預期結果:

Use a dedicated runner, run benchmarks serially, increase repetitions, and set thresholds above measured environmental variance.

安全審計

中風險

v1 • 2026/9/23 開啟版本化報告

Most alerts are lexical false positives caused by Markdown, localhost examples, and profiling terminology. Confirmed risks include privileged CPU controls, token delegation, and an unauthenticated all-interface trace viewer. Semantic review also found insecure TLS guidance and an unpinned tool installation.

已掃描檔案

5,264

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (2)

中

references/pprof.md:704-705

TLS Verification Bypass

The reference recommends an https+insecure profiling URL, which disables server certificate verification and permits interception or impersonation.

The adjacent comment explicitly says server certificate verification is skipped, and the command uses the insecure scheme.

中

SKILL.md:19 SKILL.md:32

Unpinned Tool Installation

The skill installs benchstat from a mutable latest version, reducing reproducibility and increasing exposure to an unexpected upstream release.

Both installation declarations explicitly use the mutable @latest selector rather than a fixed tool version.

能力複核項目 (18)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

references/ci-regression.md:259

sudo privilege escalation

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

This command uses sudo to change the CPU governor for every core. It can alter host-wide performance and stability.

高

references/ci-regression.md:268

sudo privilege escalation

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

This command uses sudo to disable Intel Turbo Boost through a kernel control. It changes host-wide CPU behavior.

高

references/ci-regression.md:271

sudo privilege escalation

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

This command uses sudo to disable AMD boost through a kernel control. It changes host-wide CPU behavior.

高

references/ci-regression.md:289

sudo privilege escalation

echo off | sudo tee /sys/devices/system/cpu/smt/control

This command uses sudo to disable SMT system-wide. It can reduce capacity and disrupt other workloads.

高

references/ci-regression.md:292

sudo privilege escalation

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

This command uses sudo to take a CPU core offline. An incorrect core selection can disrupt the host.

高

references/ci-regression.md:303

sudo privilege escalation

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The setup script uses sudo to change every CPU governor. Running it modifies the entire host, not only the benchmark process.

高

references/ci-regression.md:304

sudo privilege escalation

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true

The setup script uses sudo to disable Turbo Boost. Error suppression can hide an unsupported or failed system modification.

高

references/ci-regression.md:305

sudo privilege escalation

echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

The setup script uses sudo to disable SMT. Error suppression can hide a failed host-wide configuration change.

高

references/ci-regression.md:259

Linux /sys filesystem access

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The command writes to a /sys CPU governor control for all cores. This is a privileged host-wide configuration change.

高

references/ci-regression.md:268

Linux /sys filesystem access

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

The command writes to the Intel pstate no_turbo control in /sys. This changes host-wide CPU behavior.

高

references/ci-regression.md:271

Linux /sys filesystem access

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

The command writes to the AMD boost control in /sys. This changes host-wide CPU behavior.

高

references/ci-regression.md:289

Linux /sys filesystem access

echo off | sudo tee /sys/devices/system/cpu/smt/control

The command writes to the SMT control in /sys. This disables simultaneous multithreading across the host.

高

references/ci-regression.md:292

Linux /sys filesystem access

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

The command writes to a CPU online control in /sys. It can remove a processor from service.

高

references/ci-regression.md:303

Linux /sys filesystem access

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The script writes a performance governor to every matching /sys CPU control. This is a privileged host-wide change.

高

references/ci-regression.md:304

Linux /sys filesystem access

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true

The script writes to the Intel pstate no_turbo control in /sys. It suppresses errors from the system modification.

高

references/ci-regression.md:305

Linux /sys filesystem access

echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

The script writes to the SMT control in /sys. It suppresses errors from the host-wide system modification.

高

references/ci-regression.md:162

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow passes GITHUB_TOKEN to a third-party action that publishes content. A compromised action could misuse repository permissions.

高

references/trace.md:115

Hardcoded IP address

go tool trace -http=0.0.0.0:8080 trace.out

Binding the trace viewer to 0.0.0.0 exposes diagnostic data on every network interface. The example provides no authentication control.

風險因素

⚙️ 外部命令 (50)

evals/evals.json:6 evals/evals.json:7 evals/evals.json:24 evals/evals.json:32 evals/evals.json:58-86 evals/evals.json:86 evals/evals.json:115-157 evals/evals.json:157-202 evals/evals.json:202-207 evals/evals.json:207-219 evals/evals.json:219 evals/evals.json:236-240 evals/evals.json:240-265 evals/evals.json:265-292 evals/evals.json:292-312 evals/evals.json:312 evals/evals.json:445-450 evals/evals.json:450-704 evals/evals.json:704-729 evals/evals.json:729-775 evals/evals.json:775-804 evals/evals.json:804 evals/evals.json:805 evals/evals.json:809-821 evals/evals.json:821-1000 evals/evals.json:1000 evals/evals.json:1019-1080 evals/evals.json:1080 evals/evals.json:1093 evals/evals.json:1385 evals/evals.json:1484 evals/evals.json:1489-1497 evals/evals.json:1497 evals/evals.json:1542-1655 evals/evals.json:1655 evals/evals.json:1742 evals/evals.json:1767 evals/evals.json:1846 references/benchstat.md:377 references/ci-regression.md:120 references/ci-regression.md:298 references/ci-regression.md:259 references/ci-regression.md:268 references/ci-regression.md:271 references/ci-regression.md:289 references/ci-regression.md:292 references/ci-regression.md:303 references/ci-regression.md:304 references/ci-regression.md:305 SKILL.md:3

🌐 網路存取 (27)

📁 檔案系統存取 (18)

🔑 環境變數 (1)

references/ci-regression.md:162

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/samber-golang-benchmark/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-benchmark/security.svg)](https://skillstore.io/skills/samber-golang-benchmark?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/samber-golang-benchmark?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-benchmark/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/samber-golang-benchmark.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

samber. (2026). golang-benchmark security audit report (audit version 1) [Author version 1.3.2]. Skillstore. https://skillstore.io/skills/samber-golang-benchmark/audits/1

BibTeX 引用

@techreport{samber-samber-golang-benchmark-2026,
  author = {samber},
  title = {golang-benchmark security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-benchmark/audits/1},
  note = {Author version 1.3.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-benchmark security audit report (audit version 1)"
version: "1.3.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-benchmark/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-benchmark:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

規範符合度

你可以打造什麼

Validate an Optimization

Create repeatable before-and-after benchmarks and decide whether measured changes are statistically significant.

Diagnose Production Latency

Correlate runtime metrics with CPU, memory, goroutine, and trace evidence to identify expensive paths.

Prevent CI Regressions

Establish benchmark baselines, practical thresholds, and controlled runner settings for pull request checks.

試試這些提示

Write a Benchmark

Write a Go benchmark for [function]. Exclude setup time, report allocations, and use representative inputs.

Compare Two Results

Compare these baseline and candidate benchmark results. Explain significance, noise, allocation changes, and whether the optimization is supported.

Investigate a Profile

Analyze this [CPU or memory] profile summary. Identify likely application callers and recommend focused pprof commands for confirmation.

Design a Regression Gate

Design a CI benchmark gate for [repository]. Include baseline handling, sample counts, thresholds, runner controls, permissions, and failure investigation.

最佳實務

Compare versions on the same toolchain, hardware, workload, and runner configuration.
Collect multiple samples and use statistical results before making performance claims.
Preserve benchmark context, profile type, build identity, and hardware details with every result.

避免

Do not approve an optimization from one benchmark run or a nonsignificant result.
Do not run competing benchmarks concurrently on shared processors.
Do not expose profiling or trace endpoints without authentication and network restrictions.