Webperf Loading

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:42 PM UTC
• Version: 0.1.0

Overview

This skill is a disclosed Chrome DevTools web performance audit toolkit with no evidence of exfiltration, destructive behavior, or system persistence.

Install only if you are comfortable letting the agent run read-only Chrome DevTools snippets against the page you are auditing. Avoid running it on pages with highly sensitive account data unless you intend to expose page structure, resource URLs, service worker/cache metadata, and embedded hydration-size signals to the agent session.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This is a clear description-behavior mismatch. The declared description centers on page loading performance analysis: TTFB, render-blocking resources, script attribution and anti-patterns, font optimization, and resource hints. The supplied code does none of those things. Instead, it analyzes browser back-forward cache behavior and reports likely blockers and restoration state. While bfcache can be loosely related to performance, it is a distinct optimization area and not represented in the declared purpose. The code’s primary purpose is materially different from the described loading-analysis workflows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a comprehensive loading-performance analyzer centered on TTFB breakdowns, render-blocking resources, script loading anti-patterns, font optimization, resource hints validation, and automated workflows. The supplied code does something much narrower and different: it inspects CSS media queries, especially those likely unnecessary above a given breakpoint, computes counts and sizes, handles inline and external stylesheets, and estimates performance impact by device class. While CSS can relate loosely to loading and render performance, this chunk does not implement the declared core capabilities such as TTFB sub-part analysis, script attribution, font optimization, resource hints validation, or multi-phase loading audits. It also includes behavior not stated in the description, namely direct stylesheet inspection and fetching external CSS for parsing. Therefore the description does not accurately represent the actual code behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a comprehensive loading-performance analysis skill focused on TTFB decomposition, render-blocking resources, script loading anti-patterns, font optimization, and resource hints validation. The supplied code does something materially different: it checks Navigation Timing and Resource Timing entries, document.referrer, window.history, and URL parameters to infer whether the page may have been reached via a client-side redirect or SPA navigation. That is a distinct capability not mentioned in the description. Additionally, the code does not implement the major declared analyses such as TTFB sub-part breakdown, render-blocking detection, script attribution, font analysis, or resource hint validation. This is therefore a clear description/behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a comprehensive loading-analysis toolkit centered on network/server timing, render-blocking, scripts, fonts, and resource hints. The supplied code does not implement those capabilities. Instead, it performs a narrow DOM/CSS audit specifically around `content-visibility` and `contain-intrinsic-size`, which is only loosely related to loading/render performance and not mentioned in the declared description. This is a material description-behavior mismatch because the actual code's primary purpose is different and substantially narrower than the declared functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The supplied code only performs basic navigation timing breakdown using the Navigation Timing API. It does align partially with the declared TTFB/loading analysis area because it measures DNS, connection, request, and response phases. However, the declared description promises a much broader, intelligent audit system with automated workflows and analyses for render-blocking resources, script loading anti-patterns, font performance, resource hints, attribution, and integrations with other skills. None of those capabilities are present in this code chunk. The primary behavior is much narrower than the declared purpose, so this is a material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The supplied code only performs a limited client-side FCP/performance observation using the browser Performance API. It looks up the first-contentful-paint entry, reads navigation timing responseStart, and filters resources marked as render-blocking. While this partially overlaps with the declared render-blocking/loading theme, it does not implement the declared primary scope: no TTFB subpart analysis, no DNS/connection/server breakdown, no script loading anti-pattern detection, no third-party attribution, no font analysis, no resource hints validation, and no automated workflows or multi-phase audits. The description materially overstates the behavior of this specific code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a comprehensive loading analysis skill focused on TTFB, render-blocking, scripts, fonts, resource hints, and automated decision-tree workflows. The supplied code does not implement those capabilities. Instead, it only scans the current page DOM for above-the-fold images using lazy-loading patterns (`loading="lazy"`, `data-src`, `data-lazy`), computes visibility and approximate LCP candidacy, and gathers metadata such as selector, dimensions, position, fetchPriority, and possible resource transfer size. This is at best a small subset related to image/lazy-loading diagnostics, which is not the primary purpose described. The code does not analyze TTFB subparts, scripts, fonts, render-blocking resources, or resource hints, so the description materially overstates and misrepresents the behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description promises a comprehensive loading-performance analysis toolkit centered on TTFB investigation, render-blocking resources, script loading behavior, fonts, and resource hints. The supplied code does something much more specific and different: it inspects <img> elements in the DOM, determines whether they are in or out of the viewport, checks whether they lack loading="lazy" and data-src, detects hidden-container cases, and associates image resources with transfer sizes from the Performance API. This is related to page-loading performance in a general sense, but its primary purpose is an image lazy-loading audit, which is only indirectly hinted at by the description’s mention of cross-skill integration with Media/lazy loading strategy. That mention does not accurately represent this snippet’s direct functionality, and the major declared capabilities are not implemented here. Therefore the code chunk materially differs from the declared description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises a comprehensive loading-performance auditing capability spanning network timing analysis, script loading anti-patterns, render-blocking detection, resource hints, fonts, and workflow orchestration. The supplied code does not implement that broad functionality. It only examines inline CSS blocks already present in the DOM and reports their size, placement, duplication, and a few content characteristics. While inline CSS size can loosely relate to loading/render concerns, this is only a small subset and does not substantiate the declared primary purpose. Therefore the description materially overstates what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description promises a comprehensive loading-performance analysis system with multiple workflows and diagnostics across network timing, render-blocking resources, script attribution, fonts, resource hints, and backend investigation. The supplied code does only a specific inline-script audit in the browser DOM. It does identify a limited subset of script-loading anti-patterns—mainly parser-blocking inline scripts in <head>, large inline scripts, duplicates, and blocking analytics—but it does not implement the vast majority of the described functionality. Because the actual code's primary behavior is much narrower than the declared purpose, the description materially overstates the capability of this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The code only performs JavaScript execution/loading breakdown using Navigation Timing and Resource Timing entries plus DOM inspection of script tags. It estimates download duration, parse cost, blocking status, total transfer/decoded sizes, and some simple heuristics. This partially matches the declared script-performance and render-blocking portions, but the declared description is much broader and emphasizes TTFB sub-part analysis, resource hints validation, font optimization, automated workflows/decision trees, backend investigation, and cross-skill integrations, none of which appear in the supplied code. Because the supplied chunk represents only a small subset of the declared functionality, the description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a material description/behavior mismatch. The declared description promises loading diagnostics around TTFB, render-blocking resources, script loading anti-patterns, font optimization, and resource hints workflows. The supplied code does none of those primary tasks. Instead, it performs a specialized audit of SSR/hydration data embedded in the page, identifying framework-specific hydration containers/scripts and measuring their byte size against thresholds. While hydration size can broadly relate to loading performance, this implementation is not a supporting detail of the declared TTFB/render-blocking/resource-hints functionality; it is a distinct performance analysis capability with a different focus and trigger surface. No concerning extra permissions are evident, but the primary purpose is materially different from the declared one.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code is legitimate performance-analysis logic, but it covers only one slice of the declared functionality: script loading analysis. It collects resource timing data for scripts, inspects script tags, labels them as blocking/async/defer/module, attributes first vs third party, and generates findings about blocking scripts, especially in the head or from third parties. That aligns with the 'script performance deep dive' and part of 'render-blocking detection' from the description. However, the declared purpose is much broader, emphasizing TTFB sub-part analysis, font optimization, resource hints validation, automated workflows/decision trees, backend investigation, priority optimization, and cross-skill integrations. None of those capabilities appear in this code chunk. Because the actual code implements only a subset of the declared skill and lacks many headline features, the description does not accurately represent what this specific supplied code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description emphasizes general loading analysis features such as TTFB investigation, render-blocking detection, script loading anti-patterns, font optimization, and resource hints validation. The supplied code does not implement those workflows. Instead, it focuses narrowly on Service Worker behavior and Cache Storage: reading service worker registrations, checking navigation preload state, examining resource timing entries with workerStart, inferring cache hits, and enumerating Cache API contents. That is a materially different primary purpose and includes capabilities not disclosed in the description. While service workers can affect loading performance, this code does not actually perform the stated TTFB/render-blocking/script/font/resource-hints analyses, so the description does not accurately represent the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description promises a comprehensive loading-analysis skill with multiple automated workflows and decision trees. The provided code chunk does something much narrower: it reads Resource Timing entries, computes resource-level TTFB and duration, marks whether each resource is third-party by hostname comparison, and sorts/filter resources by TTFB. It does not inspect DNS lookup, connection, or server timing subparts; it does not identify render-blocking resources; it does not analyze script loading attributes or anti-patterns; and it does not validate fonts, resource hints, loading priority, or any six-phase workflow. While the code is related to one small slice of the declared domain—resource TTFB analysis—the actual implemented behavior is materially narrower than the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a comprehensive loading analysis system, but the supplied code chunk is a narrow TTFB check only. It reads the navigation timing entry, derives responseStart as a TTFB proxy, and assigns a Good/Needs Improvement/Poor classification. It does not inspect DNS, connection, or server timing sub-parts; does not detect render-blocking resources; does not analyze scripts, fonts, or resource hints; and does not implement automated workflows or multi-phase audits. While TTFB is within the declared domain, the actual code represents only a small subset of the promised functionality, making the description materially overstated for this code chunk.

Ae1

High

• Category: analysis-evasion

Content

- `scripts/Resource-Hints.js` — Resource Hints

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- `scripts/SSR-Hydration-Data-Analysis.js` — SSR Framework Hydration Data Analysis

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- `scripts/Validate-Preload-Async-Defer-Scripts.js` — Validate Preload on Async/Defer Scripts

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill instructs the agent to execute multiple browser-side scripts via Chrome DevTools and at least some of those scripts may initiate network access or inspect network-derived data, yet the manifest declares no explicit tool scope such as allowed-tools or permissions. That increases the chance of over-broad execution in environments where tool access should be constrained and makes review/auditing harder.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill advertises broad invocation phrases such as requests about slow loading, scripts, fonts, and resource hints, which can cause the agent to trigger this skill in many common browsing contexts. Over-broad activation increases the chance of unneeded script execution against arbitrary pages and can expose page data or create surprising side effects during routine conversations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Decision Tree

Use this decision tree to automatically run follow-up snippets based on results:

### After TTFB.js

• Confidence: 88% confidence
• Finding: The decision tree explicitly tells the agent to automatically run follow-up snippets based on observed results. Autonomous chaining of browser-executed scripts can expand access to page internals, network-derived data, service worker/cache state, and additional diagnostics without fresh user consent, increasing the blast radius if a script is buggy or overly invasive.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: The workflow activates when the user asks for a comprehensive loading analysis or to "audit loading performance," but the document does not clarify whether this applies only to webpage performance investigation in Chrome DevTools or more generally. Without scope constraints or negative examples, the invocation boundary is somewhat ambiguous for a manifest/markdown skill description.

Static analysis

No suspicious patterns detected.