The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/lighthouse_audit.py script executes the lighthouse command-line tool using subprocess.run. The implementation follows security best practices by passing arguments as a list and avoiding the use of a shell, which mitigates the risk of command injection. The user-provided URL is also validated to ensure it uses a valid web protocol (http/https).
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from Lighthouse audit results and local build assets. While this represents a data ingestion surface, the risk is minimized because the scripts only extract specific numeric metrics and metadata for display, rather than executing the content or using it to influence subsequent agent actions.
[EXTERNAL_DOWNLOADS]: The skill documentation and scripts refer to the lighthouse utility, which is a well-known industry-standard tool for performance measurement. The suggestion to install it via NPM represents a standard dependency management step for this functionality.

performance-profiling