1k-startup-profile

Security scan

AI scan Medium

VirusTotal scan Unknown

Summary

The skill is a startup profiling tool gated behind an env var, logging timing data for modules, HBC files, and segments. No evidence of prompt injection, dangerous operations, supply chain malware, or obfuscation. The only concern is logging detailed startup timing information that could reveal implementation details.

What looks risky

Privacy exfiltration 6.2

skill.md

The system logs detailed startup timing information including module load times and segment details. While not user data, this could theoretically reveal implementation details useful for attacks.

"Deep startup profiling for OneKey mobile — per-module JS factory timings, HBC I/O/parse breakdown, per-segment timings. Gated behind the single env var `ONEKEY_STARTUP_PROFILE=1`. Zero overhead when disabled (default). Use when diagnosing cold-start regressions, sizing main.bundle parse cost, finding slow modules, measuring segment load, or auditing what a 1.7s `require('./App')` actually contains. Triggers on: startup profile, 启动性能分析, module timing, HBC parse time, segment timing, require cost, StartupProfile, ONEKEY_STARTUP_PROFILE, __d patcher, inline-requires."