core-web-vitals

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill includes instructions that use parent directory traversal (../) within documentation links and code examples.
  • Evidence: SKILL.md contains a reference to ../performance/SKILL.md to link to a related skill.
  • Evidence: references/LCP.md contains a frontend code example importing an asset from ../assets/hero.jpg.
  • Context: These instances represent standard relative pathing within the repository structure of a multi-package catalog and do not attempt to access sensitive system files or credentials.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation and execution of official web performance monitoring tools.
  • Evidence: References npx lighthouse for lab testing and the web-vitals library for field data collection.
  • Context: These are well-known, widely-used packages maintained by Google for the purpose of the skill's primary function.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 07:53 AM