Security audit
Security checks for vulnerabilities and agentic risk
This is a web performance diagnostic skill, but it deserves review because it can chain DevTools page scripts and one scroll audit changes a page-wide browser API until the page is reloaded.
Use this skill mainly on pages you own or are comfortable inspecting through DevTools. Confirm before letting an agent run chained follow-up snippets, avoid sensitive logged-in pages unless necessary, and reload the page after Scroll-Performance.js to remove its page-level instrumentation. Treat LoAF helper exports as local performance data that may include script URLs and function names.
scripts/Scroll-Performance.js:2Persistent Global Wrapping of EventTarget.addEventListener
The code does relate to interaction performance and INP-style analysis, so the high-level domain is aligned. However, the declared description substantially overstates the implemented functionality. The supplied code only sets up a PerformanceObserver for event timing entries, groups entries by interactionId, reports duration and latency sub-parts, gives generic recommendations, and provides a basic aggregate summary. It does not implement the described automated workflows, decision trees, script attribution, scroll-jank analysis, third-party analysis, CLS correlation, animation debugging, or any explicit Chrome DevTools MCP integration. Because the declared purpose claims multiple concrete analysis capabilities that are absent from the code, this is a material description-behavior mismatch.
The supplied code is narrowly focused on layout shift monitoring. It registers a PerformanceObserver for 'layout-shift', aggregates shift values excluding recent input for CLS, tracks affected elements/selectors, and returns a summary labeled with metric 'CLS'. There is no code for interaction latency/INP measurement, event timing phase analysis, long frames, script attribution, main-thread task analysis, scroll performance, third-party impact, animation debugging, or cross-skill workflow orchestration. While the description mentions correlating layout shifts with interactions/loading as part of a broader intelligent interaction analysis tool, this chunk implements only the layout-shift/CLS portion, making the declared purpose materially broader and different from the actual behavior.
The description presents a comprehensive interaction-audit skill with automated debugging workflows for INP, scroll jank, main-thread blocking, layout-shift correlation, and cross-skill integrations. The supplied code is much more limited: it only collects and reports long animation frame entries using the browser PerformanceObserver long-animation-frame entry type, exposes helper methods on window.loafHelpers, and supports exporting the gathered data. Script attribution is present in a limited sense because it records per-frame script information and can rank top scripts, which partially aligns with the declared mention of script attribution when long frames are detected. However, most of the declared higher-level capabilities are absent from this code chunk, and the export/download behavior is not mentioned in the description. Therefore the description does not accurately represent what this specific code chunk actually does.
The code is focused specifically on scroll performance diagnostics. It monkey-patches addEventListener to record non-passive scroll/wheel/touch listeners, monitors frame intervals during scrolling, counts dropped frames, audits CSS properties like scroll-behavior, will-change, content-visibility, and overscroll-behavior, and returns a summary object. While this partially aligns with the declared mention of scroll jank investigation, the declared description presents a much broader and more automated interaction-performance analysis system centered on INP, script attribution, interaction audits, layout shift correlation, third-party analysis, and cross-skill integrations. Those capabilities are not present in the supplied code chunk, making the description materially broader than the actual behavior.
Referenced artifact was not completely inspected
- `scripts/Interactions.js` — Interactions
Referenced artifact was not completely inspected
- `scripts/Layout-Shift-Loading-and-Interaction.js` — Layout Shift Tracking
Referenced artifact was not completely inspected
- `scripts/Long-Animation-Frames-Helpers.js` — LoAF Helpers
Referenced artifact was not completely inspected
- `scripts/Long-Animation-Frames.js` — Long Animation Frames (LoAF)
Referenced artifact was not completely inspected
- `scripts/LongTask.js` — Long Tasks
The metadata promotes 'automated workflows' that automatically run additional analysis, encouraging autonomous action in a sensitive browser context. In this skill context, autonomy is more dangerous because DevTools script evaluation can inspect live page state and potentially touch authenticated sessions or user content.
---
name: webperf-interaction
description: Intelligent interaction performance analysis with automated workflows for INP debugging, scroll jank investigation, and main thread blocking. Includes decision trees that automatically run script attribution when long frames detected, break down input latency phases, and correlate layout shifts with interactions. Features workflows for complete interaction audit, third-party script impact analysis, and animation performance debugging. Cross-skill integration with Core Web Vitals (INP/CLS correlation) and Loading (script execution analysis). Use when the user asks about slow interactions, janky scrolling, unresponsive pages, or INP optimization. Compatible with Chrome DevTools MCP.
license: MIT
metadata:
author: Joan Leon | @nucliweb
The skill instructs operators to execute DevTools evaluation scripts against the active browser context without warning that page data may be inspected. In a browser-attached environment, this can lead to unintended access to sensitive DOM, interaction, and application state data, especially if the user did not expect page inspection to occur automatically.
The explicit decision tree to 'automatically run follow-up snippets' is a true autonomy concern because it delegates multi-step inspection decisions to the agent. In a Chrome DevTools MCP environment, that increases the chance of unbounded analysis of the active application without transparent user awareness.
## Decision Tree
Use this decision tree to automatically run follow-up snippets based on results:
### After Interactions.js
The decision tree repeatedly tells the agent to automatically run follow-up snippets based on observed results, which expands page inspection without renewed user approval. This is dangerous because each follow-up script may read more data from the active page than the user intended when asking an initial performance question.