web-vitals-inp-deep
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
web-vitalslibrary via the official package registry. This is a well-known, industry-standard library maintained by the Google Chrome team for measuring performance metrics. - [COMMAND_EXECUTION]: The skill includes instructions for running Playwright tests and utilizing
curlto query the Google Chrome UX Report API. These commands are standard for automated performance auditing and field data collection. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external web pages to measure interaction timings, which presents a surface for indirect prompt injection.
- Ingestion points: The agent interacts with external URLs via
page.goto()and performs UI interactions usingpage.click()within the Playwright scripts inSKILL.md. - Boundary markers: There are no explicit delimiters or instructions to ignore embedded content in the target pages, which is typical for performance testing tools.
- Capability inventory: The skill utilizes Playwright for browser automation, including
page.evaluate()andpage.addInitScript(), allowing it to execute JavaScript within the context of the page being tested. - Sanitization: The skill does not implement specific sanitization or filtering of the external web content it interacts with, as its primary goal is to measure the performance of that content as-is.
Audit Metadata