performance
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references documentation and diagnostic tools from well-known services and trusted organizations, including Google (web.dev, developer.chrome.com), Mozilla (MDN), and Cloudflare.
- [COMMAND_EXECUTION]: Employs Chrome DevTools MCP tools to initiate performance traces and analyze browser diagnostics (e.g., performance_start_trace, performance_analyze_insight).
- [INDIRECT_PROMPT_INJECTION]: The skill processes external measurement data such as real-user metrics and browser traces. This potential attack surface is addressed through explicit instructions for data privacy and sanitization.
- Ingestion points: Measurement data sourced from browser tools, CrUX field data, and RUM telemetry (references/MEASUREMENT.md).
- Boundary markers: Includes instructions to differentiate between lab measurements and source-code hypotheses to prevent over-reliance on unverified static analysis (SKILL.md).
- Capability inventory: Utilizes standard browser-based tracing and analysis tools to identify performance bottlenecks.
- Sanitization: Establishes clear guidelines to exclude personal data, query strings, and user-entered text from production telemetry payloads (references/RUM.md).
Audit Metadata