The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The README.md file instructs users to install the skill using the npx skills@latest command, which downloads content from the author's public GitHub repository.
[COMMAND_EXECUTION]: The measurement-protocol.md file provides several shell commands for common developer tasks required for performance auditing, such as using git worktree for environment isolation, npm ci and npm run build for project compilation, and grep for extracting asset links from HTML files. It also includes a Node.js one-liner used to calculate raw, gzip, and brotli file sizes along with SHA-256 hashes of build assets.
[COMMAND_EXECUTION]: The skill uses curl to fetch performance data from external sources, specifically querying Google's Chrome User Experience (CrUX) API and the PageSpeed Insights API to retrieve field data and lab scores.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external sources, including Lighthouse/PageSpeed reports, browser traces, and API responses. This represents a potential surface for indirect prompt injection if those external reports were to contain adversarial content designed to influence the agent's analysis.
Ingestion points: Performance reports, JSON data from Google APIs, and browser traces as described in SKILL.md and measurement-protocol.md.
Boundary markers: The instructions emphasize categorizing and labeling data, but do not specify technical delimiters to isolate untrusted report content from the agent's instructions.
Capability inventory: Access to project build commands, file system manipulation (cp, git), and network requests (curl).
Sanitization: No explicit sanitization or filtering of the content within performance reports is documented.

field-web-performance