pagespeed-enhancer
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of user-provided PageSpeed Insights reports or URLs.
- Ingestion points: The workflow begins in
SKILL.mdandreferences/detailed-guide.mdwhen a user pastes a performance report or provides a URL for scanning. - Boundary markers: There are no explicit delimiters or instructions for the agent to ignore instructions that might be embedded within the report content.
- Capability inventory: The skill possesses significant capabilities across its scripts, including modifying configuration files (
netlify.toml,vercel.json,vite.config.ts), HTML/CSS files, and executing shell commands for image optimization (cwebp,sips,python3). - Sanitization: The instructions do not specify any validation or sanitization of the input data before it is processed by the agent.
- [DYNAMIC_EXECUTION]: The skill utilizes dynamic script execution for asset optimization tasks.
- Evidence: In
references/detailed-guide.md, the skill providespython3 -ccommand templates to perform image resizing and icon optimization using the Pillow library. - Context: These are low-risk, template-based executions intended for local file processing and do not incorporate direct untrusted input into the command string.
Audit Metadata