performance-and-web-vitals
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches performance auditing tools such as
lighthouseand@lhci/clifrom the official npm registry. - [COMMAND_EXECUTION]: Provides commands to execute
lighthouseaudits andlhciCI runs, which are standard operations for the skill's intended purpose. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze web source files (HTML, CSS, JS), creating a surface where malicious instructions could be embedded in the audited data.
- Ingestion points: Ingests project files including
.html,.tsx,.jsx, and configuration files likenext.config.jsorvite.config.js. - Boundary markers: No specific boundary markers or delimiters are defined to isolate audited content.
- Capability inventory: The skill utilizes shell command execution via
npxandnpmto run audit tools. - Sanitization: Content is evaluated for performance metrics without explicit sanitization of embedded strings.
Audit Metadata