performance-optimization
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze data from external diagnostic tools, creating an attack surface where maliciously crafted technical output could influence behavior.\n
- Ingestion points: Lighthouse JSON reports,
EXPLAIN ANALYZEoutput, bundle analyzer profiles, and APM metrics (Datadog, New Relic) as described inSKILL.mdand the reference documentation.\n - Boundary markers: Absent. There are no instructions for the agent to treat tool outputs as untrusted or to use specific delimiters.\n
- Capability inventory: The skill assumes the agent has permissions to execute shell commands for profiling (
py-spy,perf,lighthouse) and to write code changes for performance fixes.\n - Sanitization: Absent. No validation or filtering of profiling output is mentioned.\n- [SAFE]: The skill provides legitimate, high-quality optimization guidance based on established industry practices. It references reputable sources such as Google Web Vitals and WebPageTest, and uses well-known tools without introducing suspicious dependencies or obfuscated code.
Audit Metadata