core-web-vitals
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute performance analysis tools includinglighthouse,@next/bundle-analyzer, andsource-map-explorer. These are standard tools from well-known sources in the web development ecosystem. - [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands using
npxand pipe output intojqfor JSON parsing. These commands are intended for performance auditing and bundle analysis. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (URLs and project file paths) by interpolating them into shell command strings.
- Ingestion points: User-provided target URLs for Lighthouse audits and file paths for source map exploration.
- Boundary markers: The skill does not provide specific delimiters or instructions for the agent to wrap or validate these inputs before execution.
- Capability inventory: Shell execution via
npxwith the ability to pipe to other utilities likejq. - Sanitization: There are no instructions for sanitizing, escaping, or validating the input strings before they are passed to the shell.
Audit Metadata