lighthouse
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Automated execution of repository-local scripts and development tools.
- The skill runs
scripts/psi-measure.mjsto interface with the PageSpeed Insights API. - Uses
node -eto programmatically extract performance metrics from audit JSON files. - Executes quality gate commands including
npm run typecheck,npm test, andnpm run lint:allbefore deployment. - Performs repository management via
git commitandgit pushto finalize optimizations. - [EXTERNAL_DOWNLOADS]: Retrieval of performance data from a well-known service.
- Connects to Google's PageSpeed Insights API (
https://pagespeed.web.dev/) to fetch audit reports. - [PROMPT_INJECTION]: Evaluation of the attack surface for indirect prompt injection from audit data.
- Ingestion points: Reads analysis data from JSON report files stored in the
reports/directory. - Boundary markers: Does not implement specific instruction delimiters or guardrails for external data interpolation in its prompts.
- Capability inventory: Maintains
Edit,Write, andBashcapabilities for modifying source code and executing shell commands. - Sanitization: Relies on the structured and trusted nature of data provided by the PageSpeed Insights service.
Audit Metadata