The Agent Skills Directory

[COMMAND_EXECUTION] (LOW): The script scripts/lighthouse_audit.py invokes the lighthouse CLI tool using subprocess.run.
Ingestion Point: The script accepts a URL from sys.argv[1].
Capability Inventory: Uses subprocess.run to call external software.
Analysis: Although the script correctly avoids shell=True by passing arguments as a list, it still passes user-controlled data (the URL) to an external process. This is a common pattern for utility skills and is considered low risk when using reputable tools like Lighthouse, but it technically constitutes an attack surface for indirect prompt injection or command argument manipulation if the underlying tool has vulnerabilities.
[EXTERNAL_DOWNLOADS] (SAFE): The skill documentation and scripts reference the lighthouse package from npm. This is a well-known, trusted dependency for web performance auditing.

performance-profiling