The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute performance scans using the react-doctor CLI tool via npx. This involves running shell commands to profile web applications, which is the primary purpose of the skill.
[EXTERNAL_DOWNLOADS]: The use of npx react-doctor@latest triggers a download of the package from the npm registry. Since the package is a recognized tool provided by the skill author (millionco), this is considered standard and intended functionality.
[DATA_EXPOSURE]: The skill contains explicit instructions to protect sensitive information, noting that generated trace files (.json.gz) may contain source paths and application behavior. It directs the agent to keep these files local unless upload is explicitly approved.
[CREDENTIALS_SAFE]: The instructions for using the Chrome DevTools Protocol (CDP) specifically forbid the agent from requesting cookies or copying browser profiles, which mitigates risks of credential harvesting during automated browser sessions.

performance