web-perf
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- External Package Dependency: The skill provides configuration instructions for the
chrome-devtools-mcppackage. This package is necessary for the skill to interact with browser performance APIs. While this involves downloading and running external code, the package originates from an established development project. - Processing External Content: A primary function of this skill is to audit external websites by navigating to user-provided URLs and analyzing network traffic and accessibility trees. This creates a potential surface for indirect prompt injection, where malicious instructions embedded in a target website could attempt to influence the agent's analysis or output.
- Ingestion points: Data from external websites is ingested via
navigate_page,list_network_requests,get_network_request, andtake_snapshotcommands in SKILL.md. - Boundary markers: The instructions do not define specific delimiters or warnings to isolate content retrieved from external sites.
- Capability inventory: The skill utilizes tools for browser interaction, network logging, and local codebase analysis as described in the Phase 1-5 workflows.
- Sanitization: The workflow does not include specific steps for sanitizing or validating the data retrieved from external web audits.
Audit Metadata