performance-audit
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands such as 'npm install web-vitals --no-save' to manage performance monitoring dependencies in the local environment.
- [EXTERNAL_DOWNLOADS]: Fetches the 'web-vitals' package from the official npm registry, which is a well-known service.
- [REMOTE_CODE_EXECUTION]: Utilizes Playwright's 'evaluate' function to inject and run JavaScript strings inside a target browser's context to capture performance metrics from the window object.
- [PROMPT_INJECTION]: The skill processes data from external websites, creating a surface for indirect prompt injection where malicious site content could attempt to influence the agent. 1. Ingestion points: Browser 'evaluate' return values from externally controlled URLs. 2. Boundary markers: None identified. 3. Capability inventory: Subprocess calls (npm install) and file-system writes (CSV generation). 4. Sanitization: Not identified.
Audit Metadata