frontend-performance
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external performance auditing tools and web content, creating a potential attack surface for instructions embedded in third-party reports or code.
- Ingestion points: The skill instructs the agent to run and analyze results from PageSpeed Insights and Lighthouse, and to audit source code for performance bottlenecks (SKILL.md).
- Boundary markers: Absent; there are no specific instructions to the agent to disregard instructions potentially hidden in audit results or external web source code.
- Capability inventory: The skill suggests executing development commands such as 'npm install', 'next build', and bundle analysis tools which could be targeted by an injection (SKILL.md, references/nextjs.md).
- Sanitization: Absent; no logic or instruction is provided to sanitize or validate the content of external performance reports before processing them.
Audit Metadata