Agent skill · Audited from source

webperf-snippets

skill · nucliweb/webperf-snippetsMIT licenceAudited 21 Oct 2026 · source 08f0038bb80f

★ 1,454pushed todayversion 2.0.1
!CAUTIONGrade C · 78/100 · 24 findings · 08f0038
1,454repo stars · whole nucliweb/webperf-snippets

Is it safe? With care — CAUTION, grade C (78/100). We read this skill's source at commit 08f0038bb80f and observed filesystem, network and shell access and no hard-coded secrets. The audit raised 24 findings, 0 critical or high. What it does: Intelligent Core Web Vitals analysis with automated workflows and decision trees. Measures LCP, CLS, INP with guided debugging that automatically determines follow-up analysis based on results. Includes workflows for…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “webperf-snippets (nucliweb/webperf-snippets)”. Retrieved 21 Oct 2026. https://modelsatlas.com/skills/nucliweb/webperf-snippets

Trust audit

Audit 0.4.1 · source read 21 Oct 2026

Trust score78/100!CAUTION C
0 critical0 high4 medium20 low0 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade C is shared by 84 of 14,816 audited skills.

What the source does

  • FilesystemDeclared10 observations
  • NetworkDeclared8 observations
  • ShellDeclared4 observations
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN2
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN18
L2 InstructionsPrompt injection, authority framing, hidden directivesWARN4
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (24)

MEDIUMInventory / provenanceinv.binary · assets/Sticker-Logo.afdesign
F-13 Inventory / provenanceCWE-1104Layer L0
Sticker-Logo.afdesign
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMObfuscation / stealthobf.zero_width · lib/strip-emoji.js:5
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const EMOJI = /[\p{Extended_Pictographic}✓✗][️]*/gu
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrompt injectionprompt.hidden_style · content/Media/SVG-Embedded-Bitmap-Analysis.mdx:93
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
<svg hidden>
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrompt injectionprompt.hidden_style · public/llms-full.txt:16836
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
'%c  <svg hidden>\n    <symbol id="icon-arrow" viewBox="0 0 24 24">...</symbol>\n  </svg>',
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.binary · cli/tests/fixtures/clip.webm
F-13 Inventory / provenanceCWE-1104Layer L0
clip.webm
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWCode injectioncode.eval_exec · cli/tests/e2e/interaction-returns.test.js:43
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
page.waitForFunction(([name, check]) => new Function("r", `return (${check})(r)`)(window[name]()), [getter, ready.toString()], {
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · cli/tests/helpers/contract.js:420
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const inspect = new Function(`return ${inspectSrc}`)();
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · cli/tests/unit/shared-helpers.test.js:17
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return new Function("location", "OWN_DOMAINS", `${body}\nreturn { ${names.join(", ")} };`)({ hostname }, ownDomains);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · components/diagrams/flowLayout.test.js:245
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
props[name[1]] = new Function(`return ${source.slice(i + 1, j)}`)();
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · lib/snippet-expression.test.mjs:30
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
assert.doesNotThrow(() => new Function(`return (${expression})`))
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { PageSchema } from "../../components/PageSchema";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { BASE_URL, markdownUrlOfRoute, pageOfRoute } from "../../lib/markdown-path.mjs";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:5
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { pageMetadata } from "../../lib/page-metadata";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:6
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { readPageInfo } from "../../lib/page-info";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:7
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { useMDXComponents as getMDXComponents } from "../../mdx-components";
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · .github/workflows/action.yml:32
F-04 Network egressCWE-200 · CWE-319Layer L1
curl -fsS http://127.0.0.1:8080/index.html > /dev/null
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · .github/workflows/action.yml:38
F-04 Network egressCWE-200 · CWE-319Layer L1
url: http://127.0.0.1:8080/index.html
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · .github/workflows/action.yml:54
F-04 Network egressCWE-200 · CWE-319Layer L1
url: http://127.0.0.1:8080/index.html
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · cli/tests/e2e/audit.test.js:70
F-04 Network egressCWE-200 · CWE-319Layer L1
baseUrl = `http://127.0.0.1:${port}`;
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · cli/tests/e2e/bfcache.test.js:31
F-04 Network egressCWE-200 · CWE-319Layer L1
base = `http://127.0.0.1:${server.address().port}`;
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · cli/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@modelcontextprotocol/server, @modelcontextprotocol/client, vitest
Why
3 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@dagrejs/dagre, @mdn/browser-compat-data, gray-matter, highlight.js, next, nextra, nextra-theme-docs, react
Why
12 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWPrompt injectionprompt.transfer_instruction · cli/README.md:113
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Get a key for the [Chrome UX Report API](https://developer.chrome.com/docs/crux/api) and pass it with `--crux-key` or the `CRUX_API_KEY` environment variable; prefer the variable, because a flag ends
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · content/CLI.mdx:122
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Get a key for the [Chrome UX Report API](https://developer.chrome.com/docs/crux/api) and pass it with `--crux-key` or the `CRUX_API_KEY` environment variable; prefer the variable, because a flag ends
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine

Audit 0.4.1 · source sha 08f0038bb80f · 21 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishernucliweb GitHub userOwner of the repository this skill is read from
  • Source foldernucliweb/webperf-snippetsThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict08f0038bb80fA new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Intelligent Core Web Vitals analysis with automated workflows and decision trees. Measures LCP, CLS, INP with guided debugging that automatically determines follow-up analysis based on results. Includes workflows for…

---
name: webperf-core-web-vitals
description: Intelligent Core Web Vitals analysis with automated workflows and decision trees. Measures LCP, CLS, INP with guided debugging that automatically determines follow-up analysis based on results. Includes workflows for LCP deep dive (5 phases), CLS investigation (loading vs interaction), INP debugging (latency breakdown + attribution), and cross-skill integration with loading, interaction, and media skills. Use when the user asks about Core Web Vitals, LCP optimization, layout shifts, or interaction responsiveness. Compatible with Chrome DevTools MCP.
license: MIT
metadata:
  author: Joan Leon | @nucliweb
  version: 2.0.1
  mcp-server: chrome-devtools
  category: web-performance
  repository: https://github.com/nucliweb/webperf-snippets
---

# WebPerf: Core Web Vitals

JavaScript snippets for measuring web performance in Chrome DevTools.

## Running a script

1. Run the script with `mcp__chrome-devtools__evaluate_script` and read the object it returns. The scripts have no console output, so the returned object is the result: `script`, `status` and the metric data (`value`, `rating`, `details`, `items`, `issues`), as described in `references/schema.md`.
2. When `status` is `"tracking"`, the script keeps observing the page. After the interactions, call the function named in `getDataFn` with another `mcp__chrome-devtools__evaluate_script` call, for example `getINP()`, and read the object it returns.
3. When `status` is `"error"` or `"unsupported"`, read `error`: the page may not have loaded yet, or the browser lacks the API.

Without Chrome DevTools MCP, run the same snippet with the [webperf-snippets CLI](https://webperf-snippets.net/CLI), which loads the page in headless Chromium and prints the same result objects: `npx webperf-snippets <url> --snippet <Name> --json`, where `<Name>` is the script name without `.js`. It needs Playwright and Chromium (`npm install --save-dev webperf-snippets playwright`, then `npx playwright install chromium`), and tracking snippets take `--interact-script <file>` to drive the interactions.

## Scripts

- `scripts/CLS.js` — Cumulative layout shift (CLS)
- `scripts/INP.js` — Interaction to next paint (INP)
- `scripts/LCP-Image-Entropy.js` — LCP image entropy
- `scripts/LCP-Subparts.js` — LCP subparts
- `scripts/LCP-Trail.js` — LCP trail
- `scripts/LCP-Video-Candidate.js` — LCP video candidate
- `scripts/LCP.js` — Largest contentful paint (LCP)


## Common Workflows

### Complete Core Web Vitals Audit

When the user asks for a comprehensive Core Web Vitals analysis or "audit CWV":

1. **LCP.js** - Measure Largest Contentful Paint
2. **CLS.js** - Measure Cumulative Layout Shift
3. **INP.js** - Measure Interaction to Next Paint
4. **LCP-Subparts.js** - Break down LCP timing phases
5. **LCP-Trail.js** - Track LCP candidate evolution

### LCP Deep Dive

When LCP is slow or the user asks "debug LCP" or "why is LCP slow":

1. **LCP.js** - Establish baseline LCP value
2. **LCP-Subparts.js** - Break down into TTFB, resource load, render delay
3. **LCP-Trail.js** - Identify all LCP candidates and changes
4. **LCP-Image-Entropy.js** - Check if LCP image has visual complexity issues
5. **LCP-Video-Candidate.js** - Detect if LCP is a video (poster or video element)

### CLS Investigation

When layout shifts are detected or the user asks "debug CLS" or "layout shift issues":

1. **CLS.js** - Measure overall CLS score
2. **Layout-Shift-Loading-and-Interaction.js** _(pending — available in webperf-interaction skill)_
3. Cross-reference with **webperf-loading** skill:
   - Find-Above-The-Fold-Lazy-Loaded-Images.js (lazy images causing shifts)
   - Fonts-Preloaded-Loaded-and-used-above-the-fold.js (font swap causing shifts)

### INP Debugging

When interactions feel slow or the user asks "debug INP" or "slow interactions":

1. **INP.js** - Measure overall INP value; call `getINP()` after interactions, `getINPDetails()` for the 15 slowest interactions
2. **Interactions.js** _(pending — available in webperf-interaction skill)_
3. **Input-Latency-Breakdown.js** _(pending — available in webperf-interaction skill)_
4. **Long-Animation-Frames.js** _(pending — available in webperf-interaction skill)_
5. **Long-Animation-Frames-Script-Attribution.js** _(pending — available in webperf-interaction skill)_

### Video as LCP Investigation

When LCP is a video element (detected by LCP-Video-Candidate.js):

1. **LCP-Video-Candidate.js** - Identify video as LCP candidate
2. **Video-Element-Audit.js** (from Media skill) - Audit video loading strategy
3. **LCP-Subparts.js** - Analyze video loading phases
4. Cross-reference with **webperf-loading** skill:
   - Resource-Hints-Validation.js (check for video preload)
   - Priority-Hints-Audit.js (check for fetchpriority on video)

### Image as LCP Investigation

When LCP is an image (most common case):

1. **LCP.js** - Measure LCP timing
2. **LCP-Subparts.js** - Break down timing phases
3. **LCP-Image-Entropy.js** - Analyze image complexity
4. Cross-reference with **webperf-media** skill:
   - Image-Element-Audit.js (check format, dimensions, lazy loading)
5. Cross-reference with **webperf-loading** skill:
   - Find-Above-The-Fold-Lazy-Loaded-Images.js (check if incorrectly lazy)
   - Priority-Hints-Audit.js (check for fetchpriority="high")
   - Resource-Hints-Validation.js (check for preload)

## Decision Tree

Use this decision tree to automatically run follow-up snippets based on results:

### After LCP.js

- **If LCP > 2.5s** → Run **LCP-Subparts.js** to diagnose which phase is slow
- **If LCP > 4.0s (poor)** → Run full LCP deep dive workflow (5 snippets)
- **If LCP candidate is an image** → Run **LCP-Image-Entropy.js** and **webperf-media:Image-Element-Audit.js**
- **If LCP candidate is a video** → Run **LCP-Video-Candidate.js** and **webperf-media:Video-Element-Audit.js**
- **Always run** → **LCP-Trail.js** to understand candidate evolution

### After LCP-Subparts.js

- **If TTFB phase > 600ms** 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 08f0038

Download folder ↗
git clone https://github.com/nucliweb/webperf-snippets.git
npm install
claude mcp add webperf -- npx -y webperf-snippets mcp
npx skills add nucliweb/webperf-snippets

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 08f0038bb80f only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
Claude DesktopMentioned in its text, not testedSkills for Claude Desktop · About Claude Desktop
GitHub CopilotMentioned in its text, not testedSkills for GitHub Copilot · About GitHub Copilot
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. !CAUTION C 78 / 100

    first audit · source 08f0038bb80f

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION CMODELSATLASCAUTION · C
[![ModelsAtlas: CAUTION C](https://modelsatlas.com/skills/nucliweb/webperf-snippets/badge.svg)](https://modelsatlas.com/skills/nucliweb/webperf-snippets/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: CAUTION C](https://modelsatlas.com/skills/nucliweb/webperf-snippets/badge.svg)](https://modelsatlas.com/skills/nucliweb/webperf-snippets/)

Questions about webperf-snippets

What does the webperf-snippets skill do?
Tested JavaScript snippets that measure and debug web performance. Your AI agent runs them for you, or you run them yourself in DevTools: the same code every time.
Is webperf-snippets safe to install?
With care. The audit graded it C (78/100) and found 24 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can webperf-snippets access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does webperf-snippets work with?
Its documentation mentions claude-code, claude-desktop, copilot, cursor and gemini-cli. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (08f0038bb80f), read on 2026-10-21. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.