perf-lighthouse
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate instructions for web performance auditing using industry-standard tools like Google Lighthouse.
- [COMMAND_EXECUTION]: Includes common shell commands for running performance audits and managing CI workflows.
- [EXTERNAL_DOWNLOADS]: Recommends installing standard, well-known packages such as
lighthouseand@lhci/clifrom the npm registry, as well as the standardtreosh/lighthouse-ci-actionGitHub Action. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes data from external tool outputs.
- Ingestion points:
report.jsoncontent read viafs.readFileSyncinSKILL.md. - Boundary markers: None; the skill assumes the data follows the Lighthouse JSON schema.
- Capability inventory: Shell command execution for audits and file system read access.
- Sanitization: None; it extracts numeric metrics directly from the JSON object.
Audit Metadata