perf-lighthouse

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides legitimate instructions for web performance auditing using industry-standard tools like Google Lighthouse.
  • [COMMAND_EXECUTION]: Includes common shell commands for running performance audits and managing CI workflows.
  • [EXTERNAL_DOWNLOADS]: Recommends installing standard, well-known packages such as lighthouse and @lhci/cli from the npm registry, as well as the standard treosh/lighthouse-ci-action GitHub Action.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes data from external tool outputs.
  • Ingestion points: report.json content read via fs.readFileSync in SKILL.md.
  • Boundary markers: None; the skill assumes the data follows the Lighthouse JSON schema.
  • Capability inventory: Shell command execution for audits and file system read access.
  • Sanitization: None; it extracts numeric metrics directly from the JSON object.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 02:56 PM