performance
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions for auditing URL performance via a local
seoCLI. It correctly identifies the need for aSEO_CRUX_API_KEYenvironment variable for field data and provides diagnostic logic for interpreting lab and field metrics. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied URLs to generate reports. While this is an ingestion point for external data, the skill's strict focus on specific performance metrics (LCP, INP, CLS, TBT) and its interpretation guardrails minimize the risk of malicious instructions in the target page influencing the agent's behavior. 1. Ingestion points: External URLs passed to the
seo_run_reporttool orseo perf auditcommand. 2. Boundary markers: The skill provides logical boundaries by defining specific data points to interpret (e.g.,dataStatus,labDataStatus), though explicit prompt delimiters for the tool output are not shown. 3. Capability inventory: Execution of performance audit reports via theseoCLI/MCP server and access to the packaged Lighthouse runtime. 4. Sanitization: Not explicitly handled in the skill instructions; relies on the underlying tool's handling of URL inputs.
Audit Metadata