web-performance
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/performance-auditor.pyexecutes the systemcurlcommand using a list-basedsubprocess.runcall. This is used to capture network timing metrics for the URL being audited. The response body is discarded to/dev/null, preventing data leakage. - [COMMAND_EXECUTION]: The shell script
scripts/bundle-analyzer.shruns standard filesystem commands (du,ls) to report directory and file sizes for local build artifacts. - [SAFE]: The Python scripts use
__import__to load the standarddatetimelibrary for logging purposes. This use of dynamic importing is benign and serves the skill's diagnostic reporting goals. - [SAFE]: The skill processes user-provided URLs and local JSON statistics files for auditing purposes. Analysis confirms that data is processed safely without being executed as code or exfiltrated.
Audit Metadata