core-web-vitals

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the web-vitals library and the lighthouse CLI tool, which are standard, well-known utilities for performance measurement maintained by Google.
  • [COMMAND_EXECUTION]: The instructions include examples of using npx lighthouse, which is a routine operation for developers to audit website performance.
  • [REMOTE_CODE_EXECUTION]: The skill includes a code example demonstrating how to lazy-load a third-party script from https://heavy-widget.com/widget.js. This is presented as a best practice for improving Interaction to Next Paint (INP) by deferring non-critical resources and does not represent an actual execution of untrusted code in the agent context.
  • [SAFE]: All code snippets for LCP, INP, and CLS optimization (such as Speculation Rules API, PerformanceObservers, and React/Next.js components) follow established industry best practices for frontend performance engineering.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 01:38 AM
Security Audit — agent-trust-hub — core-web-vitals