web-perf
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides utility scripts,
check-dist.mjsandcheck-head.mjs, which perform automated audits of HTML and CSS files. These scripts use standard Node.js APIs (node:fs,node:path) to read build artifacts and assert that preloads, font-display settings, and cache headers are correctly configured. - [SAFE]: A network operation is identified in
scripts/check-head.mjsusing the globalfetchAPI. This functionality is intended to allow developers to audit a live, booted web route (such as a local dev server) by fetching its HTML and analyzing the head content for performance regressions. The target URL is provided as a command-line argument by the user. - [SAFE]: The skill includes instructions for font subsetting and provides a configuration file (
font-subset.config.mjs) to maintain consistent glyph coverage between the subsetter and the assertion scripts. The text extraction logic incheck-dist.mjsincludes standard HTML entity decoding to accurately measure glyph usage, which is a benign and necessary function for its stated purpose. - [SAFE]: Dependency analysis shows the use of the
astroframework within evaluation fixtures, which is consistent with the skill's focus on modern web stacks like Astro, Vite, and SSR environments.
Audit Metadata