The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is primarily composed of JavaScript snippets intended for runtime evaluation in the browser through the mcp__chrome-devtools__evaluate_script tool. This is the standard operational mode for this performance analysis skill.
[EXTERNAL_DOWNLOADS]: Scripts such as CSS-Media-Queries-Analysis.js and Cache-Strategy-Analysis.js perform network requests using the fetch API to retrieve the content of stylesheets or the headers of page resources. These requests are necessary for analyzing the performance and configuration of the site being audited.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it processes data from untrusted web pages.
Ingestion points: Multiple scripts, including SSR-Hydration-Data-Analysis.js and Content-Visibility.js, read HTML content, CSS properties, and serialized application state directly from the DOM.
Boundary markers: The skill mitigates risk by adhering to a strict structured return schema (documented in references/schema.md), ensuring that page data is treated as values rather than executable instructions for the agent.
Capability inventory: The snippets have the capability to read any data accessible to the browser tab's context and return it to the agent for analysis.
Sanitization: The skill focuses on metric extraction and structural analysis, returning results in a JSON format that isolates untrusted content from the agent's control logic.
[DATA_EXPOSURE]: The script SSR-Hydration-Data-Analysis.js includes logic to detect sensitive keys (e.g., password, secret, token) within server-side rendering (SSR) data. This is a security auditing feature designed to alert the user to accidental data leaks on their own websites and does not represent a credential harvesting risk within the skill itself.

webperf-loading