winning-web-speed-hackathon
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests cloning the official scoring tool from a repository at
https://github.com/CyberAgentHack/web-speed-hackathon-scoring-tooland installing dependencies viapnpm install. - [COMMAND_EXECUTION]: Includes a utility script
scripts/analyze-bundle.shthat executes shell commands (find,du,sort,head,numfmt,wc) to analyze the local file system within the build directory. - [COMMAND_EXECUTION]: Instructions explicitly call for executing various CLI tools and build commands, including
npx lighthouse,npx playwright test,npx webpack-bundle-analyzer,npx glyphhanger, and image processing tools likemagickandffmpeg. - [PROMPT_INJECTION]: Indirect surface detected in
scripts/analyze-bundle.shwhich processes file names and extensions from the build directory without explicit sanitization. - Ingestion points: Reads directory content from the
distfolder (or user-specified directory). - Boundary markers: None present; the script assumes standard file names.
- Capability inventory: File system enumeration and metadata retrieval via
findandduinscripts/analyze-bundle.sh. - Sanitization: Absent; shell commands are executed directly on found file paths.
Audit Metadata