Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent web performance auditing skill that inspects media on the current browser page without hidden persistence, exfiltration, or destructive behavior.
Install only if you want an agent to run Chrome DevTools diagnostics against pages you choose. Avoid using it casually on sensitive logged-in pages unless you are comfortable with the agent reading page media URLs, DOM attributes, and performance resource metadata, and review before allowing cross-skill follow-up audits.
The declared description presents a broad, benign-seeming media optimization assistant, while the detected behavior is narrower and includes fetching SVG resource contents for inspection. This mismatch can mislead users and reviewers about what the skill actually does, reducing informed consent and making unexpected remote fetching or data access more likely to occur under a much broader activation surface.
Referenced artifact was not completely inspected
- `scripts/Video-Element-Audit.js` — Video Element Audit
The skill instructs the agent to execute Chrome DevTools scripts and the analysis indicates code with network capability, but the manifest does not declare any tool scope restrictions such as allowed-tools or permissions. That omission weakens containment and makes it easier for the skill to invoke broader capabilities than a reviewer or orchestrator may expect, especially when combined with automated workflows and cross-skill triggers.
The decision tree directs the agent to automatically run follow-up snippets based on prior results, enabling autonomous tool chaining without an explicit approval checkpoint. In a skill that can execute DevTools scripts and potentially trigger additional cross-skill actions, this increases the risk of unreviewed actions, unexpected network fetches, and scope creep beyond the user's original request.
## Decision Tree
Use this decision tree to automatically run follow-up snippets based on results:
### After Image-Element-Audit.js
The manifest description says to use the skill when the user asks about 'image optimization' or 'media loading strategy,' which are broad phrases that can appear in many general web-development conversations. The description does not provide exclusion conditions or tighter scope constraints beyond the general media-performance domain.
Phrases like 'audit images and videos,' 'optimize images,' and 'check video performance' are natural user utterances that may overlap with ordinary requests outside this specific Chrome DevTools auditing skill. The file does not pair these examples with boundaries clarifying that they apply only to browser performance analysis workflows.
No suspicious patterns detected.