skills/iannuttall/seo/performance/Gen Agent Trust Hub

performance

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides instructions for auditing URL performance via a local seo CLI. It correctly identifies the need for a SEO_CRUX_API_KEY environment variable for field data and provides diagnostic logic for interpreting lab and field metrics.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied URLs to generate reports. While this is an ingestion point for external data, the skill's strict focus on specific performance metrics (LCP, INP, CLS, TBT) and its interpretation guardrails minimize the risk of malicious instructions in the target page influencing the agent's behavior. 1. Ingestion points: External URLs passed to the seo_run_report tool or seo perf audit command. 2. Boundary markers: The skill provides logical boundaries by defining specific data points to interpret (e.g., dataStatus, labDataStatus), though explicit prompt delimiters for the tool output are not shown. 3. Capability inventory: Execution of performance audit reports via the seo CLI/MCP server and access to the packaged Lighthouse runtime. 4. Sanitization: Not explicitly handled in the skill instructions; relies on the underlying tool's handling of URL inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 04:35 PM
Security Audit — agent-trust-hub — performance