Web Auto Analyzer

What to check before installing or running this skill: 1. Confirm metadata mismatch: the registry said no required binaries, but SKILL.md expects node/npm and Lighthouse packages — ensure your environment meets the SKILL.md prerequisites. 2. Inspect automation-script.js for any code that writes out sensitive files or auto-sends data off-host (search for network calls, fetch/http libraries, or hard-coded endpoints). The provided snippet looks normal (lighthouse + chrome-launcher) but some parts were truncated; verify saveResults and memory-write behavior to ensure the skill asks before saving any data. 3. Run it in a safe environment first (local container or VM) and use non-authenticated public URLs to validate behavior. Avoid running against internal or authenticated endpoints until you’ve reviewed the code and confirmed you control credentials. 4. Run npm audit on the dependencies and review package.json versions. Keep Node up-to-date and use a recent Chrome/Chromium. 5. If you need stronger assurance, validate the GitHub repository and publisher identity (homepage is github.com/user/..., which could be a placeholder). Prefer installing from a verified repo or your own copy of the script. I flagged this skill as suspicious (not clearly malicious) because of the metadata inconsistency and the truncated files that prevent full verification; resolving those points would raise confidence.