performance-and-web-vitals

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches performance auditing tools such as lighthouse and @lhci/cli from the official npm registry.
  • [COMMAND_EXECUTION]: Provides commands to execute lighthouse audits and lhci CI runs, which are standard operations for the skill's intended purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze web source files (HTML, CSS, JS), creating a surface where malicious instructions could be embedded in the audited data.
  • Ingestion points: Ingests project files including .html, .tsx, .jsx, and configuration files like next.config.js or vite.config.js.
  • Boundary markers: No specific boundary markers or delimiters are defined to isolate audited content.
  • Capability inventory: The skill utilizes shell command execution via npx and npm to run audit tools.
  • Sanitization: Content is evaluated for performance metrics without explicit sanitization of embedded strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 02:56 AM