The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to execute diagnostic tools such as source-map-explorer and webpack-bundle-analyzer, which may involve fetching these packages from the public npm registry if they are not already installed.
[COMMAND_EXECUTION]: The skill is designed to run the project's own production build scripts and utilize shell utilities like gzip and wc to measure file sizes. This is standard behavior for a build analysis tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the project's package.json and source code, which serves as a potential surface for indirect instructions if the project files are maliciously crafted.
Ingestion points: Reads package.json and project source code files during the audit process.
Boundary markers: No explicit delimiters or boundary warnings are provided when interpolating project data into the analysis context.
Capability inventory: The skill can execute arbitrary project build tasks and diagnostic tools via the command line.
Sanitization: The skill does not explicitly sanitize or validate the content of the project files before analysis.

perf-audit