web-performance-optimization
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [Indirect Prompt Injection] (LOW): Puppeteer scripts in references/compression-monitoring.md ingest external URLs, creating a surface for indirect prompt injection from malicious web content. Evidence:
measurePerformance(url)function. Ingestion point:urlparameter. Capability:page.goto(url)andpage.evaluate(). Boundary markers: None. Sanitization: None.\n- [Command Execution] (LOW): The skill utilizespuppeteer.launch(), which initiates a browser process. While this is the intended functionality for performance measurement, it represents a capability that could be abused for Server-Side Request Forgery (SSRF) or local network probing if providing unvalidated user input to the Puppeteer function.
Audit Metadata