web-performance-audit
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill enforces a strict read-only boundary and provides clear instructions to redact sensitive information, such as tokens, credentials, and private project identifiers, from URLs and audit ledgers to prevent accidental data exposure.
- [REMOTE_CODE_EXECUTION]: Includes guidance for installing official performance monitoring tools like Chrome DevTools MCP, Playwright MCP, and React Scan via
npx. These installation pathways are designed to be guided and require explicit user authorization, targeting reputable and well-known official repositories. - [INDIRECT_PROMPT_INJECTION]: Employs defensive design by explicitly instructing the agent to treat all external content—including page text, console output, and network response bodies—as untrusted input and to disregard any instructions found within that data.
- [COMMAND_EXECUTION]: Utilizes a local Python utility script (
audit_ledger.py) for initializing and validating audit reports. The script relies on standard library functions and performs semantic checks to maintain the integrity of the collected performance evidence.
Audit Metadata