kmp-compose-web-performance
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the
chrome-devtools-mcppackage vianpx. This resource originates from the official Chrome DevTools project, which is a well-known service for web developers. - [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute
npx chrome-devtools-mcp@latest, a command that downloads and runs code from the remote npm registry at runtime. This is the standard delivery mechanism for this official developer tool. - [COMMAND_EXECUTION]: The workflow involves running local shell commands through Gradle, such as
./gradlew wasmJsBrowserDistribution, which are standard for building Kotlin Multiplatform projects. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a process for ingesting and analyzing external data generated by a browser during performance profiling.
- Ingestion points: Performance traces, network waterfall data, and Lighthouse audit reports (SKILL.md).
- Boundary markers: There are no explicit delimiters defined to separate the ingested performance data from the agent's instructions.
- Capability inventory: The agent has the ability to execute shell commands for build tasks and tool invocation.
- Sanitization: No specific filtering or validation of the browser-generated data is described.
Audit Metadata