skills/jeremylongshore/claude-code-plugins-plus-skills/validating-performance-budgets/Gen Agent Trust Hub
validating-performance-budgets
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requests authorization to execute
lighthouse,webpack, andperformancerelated commands through theBashtool to perform performance audits and bundle size checks. - [DATA_EXFILTRATION]: The
scripts/report_violation.pyscript contains asend_slackmethod that uses theurllib.requestlibrary to perform HTTP POST requests to an external Slack webhook URL. While this is the intended mechanism for reporting, it allows the transmission of data to external network endpoints. - [PROMPT_INJECTION]: The skill processes untrusted external data from metric files and tool outputs, which presents an indirect prompt injection surface. 1. Ingestion points:
performance-budgets.json,metrics.json,lighthouse.json, andconfig.json. 2. Boundary markers: None identified in the instruction set to distinguish data from instructions. 3. Capability inventory:Read,Write,Edit,Grep,Glob, and restrictedBashexecution. 4. Sanitization: The Python scripts parse JSON content into objects but do not explicitly sanitize or validate the content against embedded natural language instructions.
Audit Metadata