web-perf
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to configure their environment by running
npx -y chrome-devtools-mcp@latest. This command downloads and executes a package from the NPM registry at runtime.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to audit external web pages, creating a vulnerability surface where malicious content could attempt to influence the agent.\n - Ingestion points: Untrusted data from external URLs is ingested through
navigate_pageandtake_snapshot(SKILL.md).\n - Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore instructions that might be embedded in the audited web content.\n
- Capability inventory: The skill utilizes a suite of browser automation, network auditing, and performance profiling tools.\n
- Sanitization: The skill does not implement sanitization or validation for the DOM tree or network request data before the agent processes it.\n- [COMMAND_EXECUTION]: The skill recommends that the user execute a shell command (
npx) to initialize the required local tooling.
Audit Metadata