Is web-perf safe?
https://clawhub.ai/elithrar/web-perf
The web-perf skill is a well-structured, narrowly-scoped Chrome DevTools performance auditing workflow with no executable code, no network activity during install, and no credential access. The primary concerns are: (1) a bundled adhd-assistant skill that requests significantly broader permissions including file I/O, memory persistence, and auto-activation via trigger phrases, and (2) an unpinned npx package installation recommendation. The web-perf skill itself is benign.
Category Scores
Findings (7)
MEDIUM Bundled secondary skill with broader permissions -15 ▶
The audit target 'web-perf' was installed alongside 'adhd-assistant', a separate skill with significantly broader capability requests including persistent memory storage, file read/write for task lists, scheduling system access, and trigger-phrase-based auto-activation. While this may be a legitimate co-install, the adhd-assistant skill expands the agent's permission surface well beyond what 'web-perf' claims to need.
LOW MCP server installation recommendation via npx -8 ▶
The skill instructs the agent to recommend the user install 'chrome-devtools-mcp@latest' via npx. While this is a legitimate setup step for Chrome DevTools integration, it directs execution of a third-party npm package. The package is named specifically and can be verified, but supply chain risks exist with any npx -y invocation.
LOW Trigger-phrase auto-activation in adhd-assistant -5 ▶
The adhd-assistant skill defines broad trigger phrases ('I feel overwhelmed', 'I have too much to do', 'My brain is all over the place') that could cause the skill to activate during normal conversations, potentially overriding user intent or other skill behaviors.
LOW File read/write access requested by bundled skill -8 ▶
The adhd-assistant skill requests read/write access to user task files, dopamine menu documents, and weekly review summaries. Without proper sandboxing, this file access could be leveraged to read or write sensitive files.
LOW npx package execution recommendation -15 ▶
The skill recommends executing 'npx -y chrome-devtools-mcp@latest' which auto-installs and runs a remote package without version pinning. A compromised npm package could execute arbitrary code.
INFO Codebase reconnaissance template in Phase 5 -7 ▶
Phase 5 instructs the agent to search for build configs (webpack, vite, next.config), package.json dependencies, source maps, and polyfill configurations. This is legitimate for performance auditing but provides a structured reconnaissance methodology that maps the target project's build infrastructure.
INFO Browser navigation to arbitrary URLs -5 ▶
The navigate_page tool call accepts any URL, giving the agent capability to load arbitrary web pages. In the context of performance auditing this is expected, but it could be chained with other capabilities for unintended purposes.