audit-bundle-size
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs and uses standard development tools such as rollup-plugin-visualizer and source-map-explorer from the npm registry. These are industry-standard utilities for bundle analysis and are considered safe sources.
- [COMMAND_EXECUTION]: Executes the project's production build commands (e.g., npm run build) and utilizes shell utilities (find, ls, sort) to analyze the resulting build artifacts. These operations are necessary for the skill's primary function of auditing bundle sizes.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its research functions. 1. Ingestion points: Web search results and library documentation retrieved via firecrawl_search and Context7 in Phase 3 and Phase 4. 2. Boundary markers: Absent; there are no explicit delimiters or instructions to the agent to ignore commands found within the external content. 3. Capability inventory: The skill instructions permit the agent to modify configuration files (vite.config.ts, next.config.js) and install new packages. 4. Sanitization: Absent; no filtering is applied to documentation content before it is used to guide optimization fixes. This is a common vulnerability surface for agents performing external research and is managed by platform-level guardrails.
Audit Metadata