core-web-vitals
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The
visualize.pyscript generates HTML reports from external JSON data without properly sanitizing string fields. - Ingestion points: The script reads performance data from Lighthouse JSON files provided via the
--lighthouseflag. - Boundary markers: There are no explicit instructions or delimiters in the code to ignore potentially malicious content within the JSON structure.
- Capability inventory: The script performs a file write followed by
webbrowser.open(), which renders the generated HTML in the local browser. - Sanitization: String fields such as the URL are interpolated directly into the HTML template without escaping, allowing for potential local script injection if the source JSON is attacker-controlled.
Audit Metadata