core-web-vitals
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes instructions that use parent directory traversal (
../) within documentation links and code examples. - Evidence:
SKILL.mdcontains a reference to../performance/SKILL.mdto link to a related skill. - Evidence:
references/LCP.mdcontains a frontend code example importing an asset from../assets/hero.jpg. - Context: These instances represent standard relative pathing within the repository structure of a multi-package catalog and do not attempt to access sensitive system files or credentials.
- [EXTERNAL_DOWNLOADS]: The skill references the installation and execution of official web performance monitoring tools.
- Evidence: References
npx lighthousefor lab testing and theweb-vitalslibrary for field data collection. - Context: These are well-known, widely-used packages maintained by Google for the purpose of the skill's primary function.
Audit Metadata