The Agent Skills Directory

External Tool Execution: The skill recommends configuring the chrome-devtools-mcp server using npx. This involves fetching and executing a package from the npm registry, which is a standard procedure for enabling the required MCP functionality.- Local Configuration Access: In Phase 5, the skill performs a codebase analysis by searching for and reading project files such as package.json, webpack.config.js, and framework-specific configurations. This access is limited to identifying build tools and optimization strategies necessary for the performance audit.- Indirect Prompt Injection Surface: The skill processes untrusted data when navigating to external URLs via the navigate_page command.
Ingestion points: Data enters the context through the DOM, accessibility tree, and network requests of the target website.
Boundary markers: There are no explicit delimiters defined in the skill to separate external web content from the agent's instructions.
Capability inventory: The skill can read local filesystem configurations, execute network analysis tools, and take page snapshots.
Sanitization: No specific sanitization or filtering is applied to the content of the audited web pages.- Network Header Visibility: The get_network_request capability allows the agent to inspect detailed request information, which may include sensitive headers like cookies or authorization tokens if the audit is performed on a secure or authenticated site.

web-perf