benchmark
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, such as prompt injection, obfuscation, or unauthorized data exfiltration, were detected within the skill's instructions.
- [COMMAND_EXECUTION]: The skill performs local execution of development and build tools (e.g., Docker, TypeScript compilers, linters) to establish performance baselines. These actions are standard for the skill's stated purpose.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to target URLs and API endpoints to collect performance metrics like latency and Core Web Vitals. This activity is expected and does not involve suspicious hardcoded domains.
- [PROMPT_INJECTION]: The skill ingests data from external sources such as web page content and API responses, which represents a surface for indirect prompt injection. Ingestion points: Target URL content and API response bodies (Mode 1 and Mode 2 in SKILL.md). Boundary markers: Not specified. Capability inventory: Local command execution (build/lint/docker) and browser navigation. Sanitization: Not specified.
Audit Metadata