webperf-interaction
Fail
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONOBFUSCATIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill prominently references a CLI tool hosted at
webperf-snippets.net/CLI. This domain and specific URL have been explicitly flagged as a phishing threat by automated security scanners. - [REMOTE_CODE_EXECUTION]: The documentation in
SKILL.mdinstructs users to download and execute packages (npm install webperf-snippets playwright,npx webperf-snippets) that are associated with the flagged phishing domain, creating a high-risk path for malicious code execution. - [OBFUSCATION]: All JavaScript performance snippets in the
scripts/directory are delivered in a minified format. This reduces transparency and hampers manual security auditing of the logic being executed in the browser context. - [DYNAMIC_EXECUTION]: Several scripts, such as
scripts/Forced-Synchronous-Layout.jsandscripts/Scroll-Performance.js, utilize runtime prototype monkey-patching to intercept global browser APIs. While intended for performance monitoring, this technique is highly intrusive and can be used to monitor or manipulate user interactions and data at a low level.
Recommendations
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata