core-web-vitals
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external resources from well-known domains like YouTube for example embeds and provides links to official documentation on web.dev.
- [REMOTE_CODE_EXECUTION]: Recommends dynamic imports of third-party JavaScript and the use of the Google Lighthouse CLI tool for performance measurement.
- [METADATA_POISONING]: The metadata author field differs from the system-provided author, though the author name 'web-quality-skills' is descriptive of the skill's content.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided instructions for code optimization as an ingestion point. No boundary markers or delimiters are defined to separate instructions from code, and boundary markers are absent. The agent's capability inventory includes source code modification and execution of performance auditing tools. The skill does not provide methods for escaping or validating user inputs, so sanitization is absent.
Audit Metadata