The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill suggests a configuration for the chrome-devtools-mcp server, which involves downloading and executing the package from the official npm registry using npx. This is a standard setup procedure for this tooling ecosystem.
[PROMPT_INJECTION]: The skill is designed to ingest and analyze data from arbitrary external URLs, which constitutes an attack surface for indirect prompt injection. If an audited site contains malicious instructions, they could potentially influence the agent's behavior.
Ingestion points: External web content retrieved via navigate_page, list_network_requests, and take_snapshot in SKILL.md.
Boundary markers: No specific delimiters or safety instructions are used to isolate the data from audited sites.
Capability inventory: The skill has permissions to read local files for codebase analysis, such as package.json and build configurations (e.g., webpack.config.js, vite.config.js).
Sanitization: No explicit sanitization or filtering of the external website content is described.
[SAFE]: The skill references documentation and retrieval sources from well-known providers including web.dev and developer.chrome.com.

web-perf