web-vitals-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it processes untrusted external data such as website source code and performance reports.
- Ingestion points: The agent ingests user-provided HTML, CSS, JavaScript entry points, and JSON-formatted Lighthouse reports (SKILL.md).
- Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions for the external content being analyzed.
- Capability inventory: The skill's primary function is generating text-based optimization recommendations. It does not contain instructions for automated file system modifications, network requests, or direct shell execution beyond providing example commands for the user (SKILL.md).
- Sanitization: There are no documented steps for validating or sanitizing the input data prior to analysis.
Audit Metadata