The Agent Skills Directory

[SAFE]: The skill consists of markdown documentation and reference guides. No executable scripts, obfuscated code, or malicious persistence mechanisms were detected.
[COMMAND_EXECUTION]: The documentation in references/cwv-thresholds.md provides example commands for using curl and npx lighthouse. These are standard tools for performance auditing and do not represent a security risk in this context.
[EXTERNAL_DOWNLOADS]: The skill references the use of Google's PageSpeed Insights API to retrieve website metrics. This is a well-known service and is documented for legitimate diagnostic purposes.
[PROMPT_INJECTION]: The skill analyzes external websites based on user-provided URLs, which introduces a potential surface for indirect prompt injection. A malicious target site could host content designed to manipulate the agent's audit results.
Ingestion points: External URLs passed to commands in SKILL.md.
Boundary markers: None defined in the skill instructions.
Capability inventory: The skill suggests using network-enabled tools (curl, lighthouse) to process external data.
Sanitization: No specific content sanitization or filtering is described in the instructions.

seo