performance-audit

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content and metadata from external websites via Lighthouse and CrUX reports. This creates a surface where a maliciously crafted website could attempt to influence the agent's performance analysis.
  • Ingestion points: The url parameter in the seo_run_report tool, which fetches data from external web servers.
  • Boundary markers: The instructions provide context on how to interpret structured fields but do not define explicit boundary markers for the data content itself.
  • Capability inventory: The skill utilizes seo_list_reports, seo_describe_report, and seo_run_report to fetch and display site diagnostics.
  • Sanitization: There is no mention of sanitization or filtering of the content retrieved from the audited URLs before it is presented to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 04:35 PM
Security Audit — agent-trust-hub — performance-audit