The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites via the Lighthouse audit script. This represents an attack surface where a malicious site could attempt to inject instructions into the agent's context. However, the risk is minimized because the script only extracts numeric scores and returns hardcoded summary strings.
Ingestion points: scripts/lighthouse_audit.py accepts a URL argument for auditing.
Boundary markers: The script returns a structured JSON response to the agent.
Capability inventory: subprocess.run is used in scripts/lighthouse_audit.py to execute the audit tool.
Sanitization: The script parses the audit report and strictly selects only specific category scores (performance, accessibility, etc.), discarding other content from the audited site.
[DYNAMIC_EXECUTION]: The script scripts/lighthouse_audit.py uses subprocess.run to call the Lighthouse CLI. The command is invoked with a fixed list of arguments, which prevents shell command injection from the URL parameter.
[EXTERNAL_DOWNLOADS]: The skill requires the lighthouse CLI package. Lighthouse is an industry-standard performance auditing tool maintained by Google.

performance-profiling