The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides Node.js scripts (check-budgets.mjs, check-perf-code.mjs, check-perf-report.mjs, and check-bundle-size.mjs) designed to perform local filesystem operations, audit source code, and validate performance data. These scripts use standard Node.js APIs and do not execute arbitrary shell commands or external binaries in an unsafe manner.
[DYNAMIC_EXECUTION]: The checker script check-perf-code.mjs includes logic to identify and flag the use of dynamic code generation patterns such as eval, new Function, and string-based timers (setTimeout/setInterval). This is a security-positive feature intended to ensure applications benefit from Hermes bytecode precompilation and avoid performance-degrading or potentially unsafe runtime execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests performance reports and memory readings in JSON and plain text formats. The analysis is limited to parsing these reports to compare numeric performance data against defined quality gates. There is no execution path for instructions embedded within the data, and the risk of injection is negligible.
[DATA_EXFILTRATION]: No automated or hidden network transmission of sensitive data was found. The measurement layer templates facilitate user-initiated sharing of performance reports via the native system share sheet, ensuring transparency and user control over data export.

performance-budgets