skills/cloudflare/skills/web-perf/Gen Agent Trust Hub

web-perf

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Package Dependency: The skill provides configuration instructions for the chrome-devtools-mcp package. This package is necessary for the skill to interact with browser performance APIs. While this involves downloading and running external code, the package originates from an established development project.
  • Processing External Content: A primary function of this skill is to audit external websites by navigating to user-provided URLs and analyzing network traffic and accessibility trees. This creates a potential surface for indirect prompt injection, where malicious instructions embedded in a target website could attempt to influence the agent's analysis or output.
  • Ingestion points: Data from external websites is ingested via navigate_page, list_network_requests, get_network_request, and take_snapshot commands in SKILL.md.
  • Boundary markers: The instructions do not define specific delimiters or warnings to isolate content retrieved from external sites.
  • Capability inventory: The skill utilizes tools for browser interaction, network logging, and local codebase analysis as described in the Phase 1-5 workflows.
  • Sanitization: The workflow does not include specific steps for sanitizing or validating the data retrieved from external web audits.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 08:32 PM