performance-audit
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content and metadata from external websites via Lighthouse and CrUX reports. This creates a surface where a maliciously crafted website could attempt to influence the agent's performance analysis.
- Ingestion points: The
urlparameter in theseo_run_reporttool, which fetches data from external web servers. - Boundary markers: The instructions provide context on how to interpret structured fields but do not define explicit boundary markers for the data content itself.
- Capability inventory: The skill utilizes
seo_list_reports,seo_describe_report, andseo_run_reportto fetch and display site diagnostics. - Sanitization: There is no mention of sanitization or filtering of the content retrieved from the audited URLs before it is presented to the agent.
Audit Metadata