Security audit
Security checks for vulnerabilities and agentic risk
This skill is a web performance helper, but it overstates its browser script capability and encourages automatic follow-up script execution without clear user control.
Review before installing. Only use this skill on pages you are comfortable inspecting through DevTools, confirm each script run explicitly, and do not rely on its current network metrics without fixing the included snippet to return the claimed connection data.
The description substantially overstates the functionality. While the code touches the Network Information API, it does not analyze network quality, read and act on connection properties, or implement any adaptive loading behavior. Its actual behavior is limited to feature detection and attaching a no-op listener, which is materially different from the declared purpose.
The activation guidance is broad enough that the skill may trigger for routine performance questions, causing unnecessary execution of browser-evaluation snippets in a live page context. Overbroad invocation criteria increase the chance of running active inspection code without sufficiently specific user intent or scope confirmation.
The skill directly instructs use of mcp__chrome-devtools__evaluate_script, which runs active JavaScript in the inspected page context, but it does not warn about side effects, privacy exposure, or the need for user authorization. In a browser-analysis environment, silent execution guidance is risky because even diagnostic scripts can read page state, trigger handlers, or affect application behavior.
The workflow boundaries between this skill and related performance skills are unclear, which can lead to unnecessary chaining across multiple tools and scripts. In an agent setting, ambiguous routing raises the risk of excessive code execution, data collection, or scope creep beyond what the user intended.
The skill promotes autonomous decision making by telling the agent to 'automatically run' follow-up snippets based on observed conditions. In a security-sensitive tool environment, this reduces human oversight and can cause cascading tool use, broader inspection, and unreviewed actions in the target browser context.
## Decision Tree
Use this decision tree to automatically run follow-up snippets based on results:
### After Network-Bandwidth-Connection-Quality.js
The phrase 'automatically run follow-up snippets' is unsafe in a skill that operates through Chrome DevTools script evaluation, because it encourages autonomous execution based on intermediate results rather than explicit user consent. This can expand the number of active scripts executed in the inspected page context and make agent behavior less predictable and less controllable.
The quoted trigger phrase 'optimize for mobile' or similar wording is generic and likely to match many benign optimization requests. This primarily creates an overreach risk where the agent may pivot into live script execution when a high-level advisory answer would have been sufficient.
No suspicious patterns detected.