web-perf
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/lh-ab.mjsutility uses thechild_processmodule to rungitcommands and project build scripts. This functionality is intended for local A/B testing of performance metrics between different git references. - [EXTERNAL_DOWNLOADS]: The
scripts/check-head.mjsscript utilizes thefetchAPI to retrieve HTML from a URL provided in command-line arguments, which is used to verify the performance invariants of a running application. Additionally,scripts/lh-ab.mjsusesnpxorpnpm dlxto run the official Google Lighthouse tool, which may involve downloading the package from the npm registry. - [INDIRECT_PROMPT_INJECTION]: The skill's diagnostic loop involves ingesting and analyzing HTML, CSS, and font configuration files from the user's project. While this processes external data, the analysis is performed using deterministic scripts focused on performance assertions, and no specific injection vulnerabilities were detected.
Audit Metadata