core-web-vitals

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute performance analysis tools including lighthouse, @next/bundle-analyzer, and source-map-explorer. These are standard tools from well-known sources in the web development ecosystem.
  • [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands using npx and pipe output into jq for JSON parsing. These commands are intended for performance auditing and bundle analysis.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (URLs and project file paths) by interpolating them into shell command strings.
  • Ingestion points: User-provided target URLs for Lighthouse audits and file paths for source map exploration.
  • Boundary markers: The skill does not provide specific delimiters or instructions for the agent to wrap or validate these inputs before execution.
  • Capability inventory: Shell execution via npx with the ability to pipe to other utilities like jq.
  • Sanitization: There are no instructions for sanitizing, escaping, or validating the input strings before they are passed to the shell.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 07:12 AM
Security Audit — agent-trust-hub — core-web-vitals