web-perf
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to configure the
chrome-devtools-mcppackage from the NPM registry to provide the necessary analysis tools. - [COMMAND_EXECUTION]: The agent is directed to analyze local codebase configuration files (e.g.,
package.json,webpack.config.js) to identify optimization opportunities for the developer. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes data from untrusted external URLs and local project files.
- Ingestion points: Web page content and accessibility trees retrieved through tool calls specified in SKILL.md.
- Boundary markers: No explicit delimiters are used to separate untrusted tool output from the agent's instructions.
- Capability inventory: The skill utilizes network navigation and local filesystem read access via the associated MCP server.
- Sanitization: No specific sanitization or filtering logic is defined for the content retrieved from external sources.
Audit Metadata