The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to audit performance, including project-specific build scripts and standard analysis tools via npx.
Evidence includes usage of gzip, wc, and npx to run utilities like source-map-explorer and webpack-bundle-analyzer.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and acts upon content from a project's package.json file.
Ingestion points: Reads package.json to detect build tools and scripts.
Boundary markers: None specified in the skill instructions to separate untrusted project data from agent instructions.
Capability inventory: The skill has the capability to execute shell commands (npx, gzip) and run production build tasks defined within the project files.
Sanitization: No explicit sanitization or validation of the build scripts found in package.json is described before execution.

perf-audit