react
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and add a dependency from an external repository using the command
npx skills add https://github.com/addyosmani/web-quality-skills. This source belongs to a well-known industry contributor. - [INDIRECT_PROMPT_INJECTION]: The skill processes external performance data, such as traces and Lighthouse reports, to generate optimization suggestions.
- Ingestion points: The agent reads output from performance measurement tools including
performance_start_trace,performance_analyze_insight, and Lighthouse CLI. - Boundary markers: No specific delimiters or safety instructions are defined for processing the external tool outputs.
- Capability inventory: The skill is designed to suggest code changes (e.g., dynamic imports, parallel fetching) based on the ingested data but does not contain arbitrary command execution or network exfiltration logic.
- Sanitization: No explicit sanitization or validation of the tool output content is mentioned.
Audit Metadata