Web Auto Analyzer

Automatically analyze websites for performance metrics and audit issues using Lighthouse.

Security Scan

The skill appears to implement a legitimate Lighthouse-based website auditor, but there are inconsistencies between the declared registry metadata and the SKILL.md instructions and a few implementation details that you should verify before installing or running it on sensitive sites.

Purpose & Capability

Name/description match the included files: the package contains a Node script (automation-script.js), package.json, and documentation for running Lighthouse/Chrome. However the registry metadata earlier reported no required binaries/env, while SKILL.md metadata explicitly requires node, npm and npm packages (lighthouse, chrome-launcher). That mismatch is an incoherence you should confirm with the publisher.

Instruction Scope

SKILL.md instructs running the local Node script and saving JSON/HTML reports to ./results; it warns about authenticated URLs and says to ask before saving to memory. The runtime instructions only reference local Node/npm, Lighthouse, and Chrome; they do not ask to read unrelated host files or environment variables. Note: running an audit fetches the target URL (normal) and may trigger third-party trackers on the audited site — avoid auditing authenticated/internal URLs unless you understand the implications.

Install Mechanism

No install spec is included (instruction-only style) and the package files are provided directly. package.json lists lighthouse and chrome-launcher as dependencies — expected for purpose. There are no downloads from obscure URLs in the install docs; example Chrome install uses Google-hosted deb, and Puppeteer is suggested as an option. Overall install risk is typical for a Node-based Lighthouse tool.

Credentials

The skill requests no secrets or environment variables in the registry metadata, which is appropriate. But SKILL.md metadata requires node/npm and npm packages — the registry-level 'required binaries: none' contradicts that. Also the skill will access the network to fetch audited URLs (expected) and writes reports to disk. Confirm there are no hidden env/credential reads in the rest of the code (some files truncated).

Persistence & Privilege

always is false and user-invocable is true. Autonomous invocation is allowed (platform default) but not combined here with broad credential access. SKILL.md states the skill will ask before saving to memory; verify automation-script.js actually prompts or requires confirmation before persisting any user-tracking memory.

What to consider before installing

What to check before installing or running this skill: 1. Confirm metadata mismatch: the registry said no required binaries, but SKILL.md expects node/npm and Lighthouse packages — ensure your environment meets the SKILL.md prerequisites. 2. Inspect automation-script.js for any code that writes out sensitive files or auto-sends data off-host (search for network calls, fetch/http libraries, or hard-coded endpoints). The provided snippet looks normal (lighthouse + chrome-launcher) but some parts were truncated; verify saveResults and memory-write behavior to ensure the skill asks before saving any data. 3. Run it in a safe environment first (local container or VM) and use non-authenticated public URLs to validate behavior. Avoid running against internal or authenticated endpoints until you’ve reviewed the code and confirmed you control credentials. 4. Run npm audit on the dependencies and review package.json versions. Keep Node up-to-date and use a recent Chrome/Chromium. 5. If you need stronger assurance, validate the GitHub repository and publisher identity (homepage is github.com/user/..., which could be a placeholder). Prefer installing from a verified repo or your own copy of the script. I flagged this skill as suspicious (not clearly malicious) because of the metadata inconsistency and the truncated files that prevent full verification; resolving those points would raise confidence.

When to Use

User wants to automatically analyze a website URL for performance metrics, accessibility, SEO, or best practices without manual Chrome DevTools interaction.

Core Rules

1. Verify prerequisites — Check Node.js (v18+) and packages installed: node --version && npm list lighthouse chrome-launcher

2. Run Lighthouse audit — Execute node automation-script.js <URL> [--mobile] [--output=DIR] to collect all metrics.

3. Extract and present metrics — Use tables for scores (0-100) and metrics with status indicators (⚪ Good, 🟡 Warning, 🔴 Critical).

4. Identify critical issues — Flag metrics outside thresholds: LCP>2.5s, CLS>0.1, INP>200ms, TBT>200ms, Performance<50.

5. Provide actionable fixes — For each issue, include specific code fixes from audit-checklist.md and metrics-reference.md.

6. Save results — Store JSON and HTML reports in ./results/. Ask user before saving to memory for tracking.

7. Handle errors gracefully — If audit fails, check troubleshooting.md for common solutions (Chrome not found, ES module errors, memory issues).

Quick Reference

Topic	File
Automation script	automation-script.js
Metrics & thresholds	metrics-reference.md
Fix checklists	audit-checklist.md
Setup guide	setup.md
Quick start	quick-start.md
Troubleshooting	troubleshooting.md
Memory tracking	memory-template.md

Data Storage

After analysis, offer to save: URL, timestamp, scores, critical issues, report path. Always ask before saving to memory.

Security & Privacy

• Runs locally in headless Chrome — no external data transmission
• Warn before analyzing authenticated URLs
• JSON reports contain URL structure — handle sensitive paths carefully

Common Commands

# Quick audit (desktop)
node automation-script.js https://example.com

# Mobile emulation
node automation-script.js https://example.com --mobile

# Custom output directory
node automation-script.js https://example.com --output=./reports

# Lighthouse CLI directly
lighthouse https://example.com --output=json --output-path=report.json

Troubleshooting Quick Reference

Error	Solution
"lighthouse is not a function"	Add "type": "module" to package.json
"Chrome not found"	Install Chrome or use npm install puppeteer
"JavaScript heap out of memory"	Run with node --max-old-space-size=4096
"Port already in use"	Specify different port in script config