web-perf
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external web content and local source code, which serves as a potential vector for indirect prompt injection.
- Ingestion points: External websites accessed via
navigate_pageand local project files (e.g.,package.json, framework configurations) audited in the codebase analysis phase. - Boundary markers: The skill does not provide instructions to use delimiters or warnings to treat the content of audited pages or files as untrusted data.
- Capability inventory: The skill utilizes network request tools, accessibility snapshots, and file analysis to perform its tasks.
- Sanitization: No sanitization or filtering of the ingested external content is specified before the agent processes it.
- [EXTERNAL_DOWNLOADS]: Recommends the installation of the
chrome-devtools-mcppackage from the official NPM registry to provide the necessary performance auditing tools.
Audit Metadata