ClawHub
Back to skill

Security audit

Webperf Core Web Vitals

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed web performance debugging helper that runs page-local Core Web Vitals snippets and does not show hidden data access, persistence, or destructive behavior.

Install only if you are comfortable letting the agent run JavaScript diagnostics in pages you are debugging. The snippets can inspect page performance and element metadata and may add temporary outlines to page elements, but no hidden persistence or data exfiltration was found.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description promises an intelligent, automated Core Web Vitals analysis system covering LCP, CLS, and INP with guided follow-up logic and multiple investigative workflows. The supplied code does something much narrower: it measures cumulative layout shift via PerformanceObserver, ignores recent-input shifts, and returns a basic CLS score with thresholds. There is no evidence of LCP or INP support, no debugging workflow orchestration, no decision-tree behavior, and no integration with other skills. This is a material description-to-behavior mismatch because the code's primary purpose is only simple CLS measurement.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The description claims a broad, intelligent Core Web Vitals analysis capability covering LCP, CLS, and INP with automated follow-up workflows and cross-skill integration. However, the provided code chunk is narrowly scoped to INP. It observes browser 'event' performance entries, tracks interaction durations, computes an INP-like value, classifies it against thresholds, attributes the worst event to a target element, and returns summary/detail objects. There is no code for LCP, CLS, workflow logic, decision trees, or integration with other skills. This is a material description-behavior mismatch because the actual code implements only one subset of the declared functionality.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description presents a full-featured Core Web Vitals analysis capability spanning LCP, CLS, and INP with guided debugging workflows and automated follow-up decisions. The supplied code chunk does something much narrower: it observes largest-contentful-paint entries, scans document images, computes approximate bits-per-pixel from resource size and dimensions, flags low-entropy images, and reports whether the current LCP image may be skipped by Chrome. This is related to LCP debugging, so it is not wholly unrelated, but it materially underdelivers relative to the declared purpose. The primary behavior is a specialized LCP image entropy check, not an intelligent multi-metric Core Web Vitals workflow engine.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description presents a broad, multi-workflow Core Web Vitals analysis system with guided debugging for LCP, CLS, and INP. The supplied code chunk is much narrower: it is a single browser-side LCP sub-part analysis snippet. It observes largest-contentful-paint entries, computes timing breakdowns from navigation/resource entries, optionally outlines the LCP element, and creates performance measures. There is no evidence of any logic for CLS, INP, multi-phase workflows, automatic decision trees, follow-up analysis selection, or integration with other skills. While the LCP portion aligns partially with the description, the overall declared purpose materially overstates the actual behavior of this code chunk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared description presents a broad, intelligent Core Web Vitals analyzer spanning LCP, CLS, and INP with automated workflows and integrations. The supplied code chunk, however, only implements a narrow browser-side LCP trail utility: it reads performance entries, observes largest-contentful-paint, outlines candidate DOM elements, classifies the element type, and handles missing-entry errors. This is materially narrower than the declared purpose and lacks the advertised multi-metric analysis and workflow logic. While LCP analysis is part of the declared scope, the chunk does not substantiate the overall description, so this is a description-behavior mismatch.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description promises an intelligent, automated Core Web Vitals analysis system covering LCP, CLS, and INP with guided debugging workflows and decision-tree-based follow-up analysis. The supplied code does not do that. It is a single-purpose LCP diagnostic snippet focused specifically on whether the LCP element is a VIDEO and whether its poster image is optimized via preload, fetchpriority, format, and related attributes. It does not analyze CLS or INP, does not contain any workflow orchestration or decision-tree logic, and does not integrate with other skills. While the code is related to one small part of LCP optimization, its actual scope is materially narrower than the declared primary purpose, so the description does not accurately represent the code chunk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The description presents a broad Core Web Vitals analysis capability spanning multiple metrics and guided diagnostic workflows. The provided code chunk only handles LCP, and even there it performs a limited task: listens for LCP entries, calculates the latest LCP value, and visually outlines the implicated element. There is no evidence of decision logic, workflow automation, CLS/INP support, attribution breakdowns, or integration with other skills. This is a material description-to-behavior mismatch because the implemented functionality is substantially narrower than the declared primary purpose.

Ae1

High
Category
analysis-evasion
Content
- `scripts/LCP-Image-Entropy.js` — LCP Image Entropy
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/LCP-Sub-Parts.js` — LCP Sub-Parts
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/LCP-Trail.js` — LCP Trail
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/LCP.js` — Largest Contentful Paint (LCP)
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Decision Tree

Use this decision tree to automatically run follow-up snippets based on results:

### After LCP.js
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.