The Agent Skills Directory

[SAFE]: The skill operates entirely within the local repository context to perform performance audits. It follows standard development practices for identifying Core Web Vitals issues such as Largest Contentful Paint (LCP) and Cumulative Layout Shift (CLS).
[REMOTE_CODE_EXECUTION]: The instructions mention running existing Lighthouse or Web Vitals scripts if they are present in the repository. This is a standard project-specific auditing activity and does not involve downloading or executing code from untrusted external sources.
[DATA_EXFILTRATION]: No network operations or external data transmission patterns were detected. The skill writes performance reports to a local directory (docs/site/qa/).
[INDIRECT_PROMPT_INJECTION]: The skill processes local source code (HTML, CSS, assets) as data. While it lacks explicit boundary markers for this content, the risk is negligible as the output is a static performance report and the capabilities are limited to local file reading and writing within the project structure.
Ingestion points: Reads repository files (docs/agents/stack.md) and project source assets (HTML/CSS/JS).
Boundary markers: None provided in the instructions.
Capability inventory: Reading local files and writing report files to the local file system.
Sanitization: The skill relies on standard LLM processing of code files.

perf-pass