third-party-scripts
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill contains standard front-end performance optimization guidelines and code snippets. The external URLs provided (frontendchecklist.io, pagespeed.web.dev, youtube.com) are well-known or author-owned resources used for documentation and measurement purposes.
- [INDIRECT_PROMPT_INJECTION]: The skill encourages the agent to audit external web pages and third-party scripts. This introduces a potential surface for indirect prompt injection, where malicious instructions embedded in a target website's source code or metadata could attempt to influence the agent's audit report or subsequent actions.
- Ingestion points: Analysis of third-party script tags, network requests, and performance metrics from arbitrary websites.
- Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded in audited content.
- Capability inventory: The skill facilitates the agent's ability to read and report on external web content.
- Sanitization: There are no explicit instructions for the agent to sanitize or escape data retrieved from external sources before processing it.
Audit Metadata