web-vitals-inp-deep

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the web-vitals library via the official package registry. This is a well-known, industry-standard library maintained by the Google Chrome team for measuring performance metrics.
  • [COMMAND_EXECUTION]: The skill includes instructions for running Playwright tests and utilizing curl to query the Google Chrome UX Report API. These commands are standard for automated performance auditing and field data collection.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external web pages to measure interaction timings, which presents a surface for indirect prompt injection.
  • Ingestion points: The agent interacts with external URLs via page.goto() and performs UI interactions using page.click() within the Playwright scripts in SKILL.md.
  • Boundary markers: There are no explicit delimiters or instructions to ignore embedded content in the target pages, which is typical for performance testing tools.
  • Capability inventory: The skill utilizes Playwright for browser automation, including page.evaluate() and page.addInitScript(), allowing it to execute JavaScript within the context of the page being tested.
  • Sanitization: The skill does not implement specific sanitization or filtering of the external web content it interacts with, as its primary goal is to measure the performance of that content as-is.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 10:15 AM