skills/connorads/dotfiles/web-perf/Gen Agent Trust Hub

web-perf

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/lh-ab.mjs utility uses the child_process module to run git commands and project build scripts. This functionality is intended for local A/B testing of performance metrics between different git references.
  • [EXTERNAL_DOWNLOADS]: The scripts/check-head.mjs script utilizes the fetch API to retrieve HTML from a URL provided in command-line arguments, which is used to verify the performance invariants of a running application. Additionally, scripts/lh-ab.mjs uses npx or pnpm dlx to run the official Google Lighthouse tool, which may involve downloading the package from the npm registry.
  • [INDIRECT_PROMPT_INJECTION]: The skill's diagnostic loop involves ingesting and analyzing HTML, CSS, and font configuration files from the user's project. While this processes external data, the analysis is performed using deterministic scripts focused on performance assertions, and no specific injection vulnerabilities were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 05:21 PM