Agent skill · Audited from source
webperf-snippets
skill · nucliweb/webperf-snippetsMIT licenceAudited 21 Oct 2026 · source 08f0038bb80f
Is it safe? With care — CAUTION, grade C (78/100). We read this skill's source at commit 08f0038bb80f and observed filesystem, network and shell access and no hard-coded secrets. The audit raised 24 findings, 0 critical or high. What it does: Intelligent Core Web Vitals analysis with automated workflows and decision trees. Measures LCP, CLS, INP with guided debugging that automatically determines follow-up analysis based on results. Includes workflows for…
Cite
Cite this page
ModelsAtlas. “webperf-snippets (nucliweb/webperf-snippets)”. Retrieved 21 Oct 2026. https://modelsatlas.com/skills/nucliweb/webperf-snippets
Trust audit
Audit 0.4.1 · source read 21 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade C is shared by 84 of 14,816 audited skills.
What the source does
- FilesystemDeclared10 observations
- NetworkDeclared8 observations
- ShellDeclared4 observations
- DependenciesNot pinnedSome versions float
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 2 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | WARN | 18 |
L2 Instructions | Prompt injection, authority framing, hidden directives | WARN | 4 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (24)
MEDIUMInventory / provenanceinv.binary · assets/Sticker-Logo.afdesign
Sticker-Logo.afdesign
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
MEDIUMObfuscation / stealthobf.zero_width · lib/strip-emoji.js:5
const EMOJI = /[\p{Extended_Pictographic}✓✗][️]*/gu- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInventory / provenanceinv.binary · cli/tests/fixtures/clip.webm
clip.webm
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
LOWCode injectioncode.eval_exec · cli/tests/e2e/interaction-returns.test.js:43
page.waitForFunction(([name, check]) => new Function("r", `return (${check})(r)`)(window[name]()), [getter, ready.toString()], {- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · cli/tests/helpers/contract.js:420
const inspect = new Function(`return ${inspectSrc}`)();- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · cli/tests/unit/shared-helpers.test.js:17
return new Function("location", "OWN_DOMAINS", `${body}\nreturn { ${names.join(", ")} };`)({ hostname }, ownDomains);- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · components/diagrams/flowLayout.test.js:245
props[name[1]] = new Function(`return ${source.slice(i + 1, j)}`)();- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · lib/snippet-expression.test.mjs:30
assert.doesNotThrow(() => new Function(`return (${expression})`))- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:2
import { PageSchema } from "../../components/PageSchema";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:4
import { BASE_URL, markdownUrlOfRoute, pageOfRoute } from "../../lib/markdown-path.mjs";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:5
import { pageMetadata } from "../../lib/page-metadata";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:6
import { readPageInfo } from "../../lib/page-info";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · app/[[...mdxPath]]/page.jsx:7
import { useMDXComponents as getMDXComponents } from "../../mdx-components";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · .github/workflows/action.yml:32
curl -fsS http://127.0.0.1:8080/index.html > /dev/null
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · .github/workflows/action.yml:38
url: http://127.0.0.1:8080/index.html
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · .github/workflows/action.yml:54
url: http://127.0.0.1:8080/index.html
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · cli/tests/e2e/audit.test.js:70
baseUrl = `http://127.0.0.1:${port}`;- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · cli/tests/e2e/bfcache.test.js:31
base = `http://127.0.0.1:${server.address().port}`;- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · cli/package.json
@modelcontextprotocol/server, @modelcontextprotocol/client, vitest
- Why
- 3 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · package.json
@dagrejs/dagre, @mdn/browser-compat-data, gray-matter, highlight.js, next, nextra, nextra-theme-docs, react
- Why
- 12 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWPrompt injectionprompt.transfer_instruction · cli/README.md:113
Get a key for the [Chrome UX Report API](https://developer.chrome.com/docs/crux/api) and pass it with `--crux-key` or the `CRUX_API_KEY` environment variable; prefer the variable, because a flag ends
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · content/CLI.mdx:122
Get a key for the [Chrome UX Report API](https://developer.chrome.com/docs/crux/api) and pass it with `--crux-key` or the `CRUX_API_KEY` environment variable; prefer the variable, because a flag ends
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
Audit 0.4.1 · source sha 08f0038bb80f · 21 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishernucliweb GitHub userOwner of the repository this skill is read from
- Source foldernucliweb/webperf-snippetsThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict08f0038bb80fA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Intelligent Core Web Vitals analysis with automated workflows and decision trees. Measures LCP, CLS, INP with guided debugging that automatically determines follow-up analysis based on results. Includes workflows for…
--- name: webperf-core-web-vitals description: Intelligent Core Web Vitals analysis with automated workflows and decision trees. Measures LCP, CLS, INP with guided debugging that automatically determines follow-up analysis based on results. Includes workflows for LCP deep dive (5 phases), CLS investigation (loading vs interaction), INP debugging (latency breakdown + attribution), and cross-skill integration with loading, interaction, and media skills. Use when the user asks about Core Web Vitals, LCP optimization, layout shifts, or interaction responsiveness. Compatible with Chrome DevTools MCP. license: MIT metadata: author: Joan Leon | @nucliweb version: 2.0.1 mcp-server: chrome-devtools category: web-performance repository: https://github.com/nucliweb/webperf-snippets --- # WebPerf: Core Web Vitals JavaScript snippets for measuring web performance in Chrome DevTools. ## Running a script 1. Run the script with `mcp__chrome-devtools__evaluate_script` and read the object it returns. The scripts have no console output, so the returned object is the result: `script`, `status` and the metric data (`value`, `rating`, `details`, `items`, `issues`), as described in `references/schema.md`. 2. When `status` is `"tracking"`, the script keeps observing the page. After the interactions, call the function named in `getDataFn` with another `mcp__chrome-devtools__evaluate_script` call, for example `getINP()`, and read the object it returns. 3. When `status` is `"error"` or `"unsupported"`, read `error`: the page may not have loaded yet, or the browser lacks the API. Without Chrome DevTools MCP, run the same snippet with the [webperf-snippets CLI](https://webperf-snippets.net/CLI), which loads the page in headless Chromium and prints the same result objects: `npx webperf-snippets <url> --snippet <Name> --json`, where `<Name>` is the script name without `.js`. It needs Playwright and Chromium (`npm install --save-dev webperf-snippets playwright`, then `npx playwright install chromium`), and tracking snippets take `--interact-script <file>` to drive the interactions. ## Scripts - `scripts/CLS.js` — Cumulative layout shift (CLS) - `scripts/INP.js` — Interaction to next paint (INP) - `scripts/LCP-Image-Entropy.js` — LCP image entropy - `scripts/LCP-Subparts.js` — LCP subparts - `scripts/LCP-Trail.js` — LCP trail - `scripts/LCP-Video-Candidate.js` — LCP video candidate - `scripts/LCP.js` — Largest contentful paint (LCP) ## Common Workflows ### Complete Core Web Vitals Audit When the user asks for a comprehensive Core Web Vitals analysis or "audit CWV": 1. **LCP.js** - Measure Largest Contentful Paint 2. **CLS.js** - Measure Cumulative Layout Shift 3. **INP.js** - Measure Interaction to Next Paint 4. **LCP-Subparts.js** - Break down LCP timing phases 5. **LCP-Trail.js** - Track LCP candidate evolution ### LCP Deep Dive When LCP is slow or the user asks "debug LCP" or "why is LCP slow": 1. **LCP.js** - Establish baseline LCP value 2. **LCP-Subparts.js** - Break down into TTFB, resource load, render delay 3. **LCP-Trail.js** - Identify all LCP candidates and changes 4. **LCP-Image-Entropy.js** - Check if LCP image has visual complexity issues 5. **LCP-Video-Candidate.js** - Detect if LCP is a video (poster or video element) ### CLS Investigation When layout shifts are detected or the user asks "debug CLS" or "layout shift issues": 1. **CLS.js** - Measure overall CLS score 2. **Layout-Shift-Loading-and-Interaction.js** _(pending — available in webperf-interaction skill)_ 3. Cross-reference with **webperf-loading** skill: - Find-Above-The-Fold-Lazy-Loaded-Images.js (lazy images causing shifts) - Fonts-Preloaded-Loaded-and-used-above-the-fold.js (font swap causing shifts) ### INP Debugging When interactions feel slow or the user asks "debug INP" or "slow interactions": 1. **INP.js** - Measure overall INP value; call `getINP()` after interactions, `getINPDetails()` for the 15 slowest interactions 2. **Interactions.js** _(pending — available in webperf-interaction skill)_ 3. **Input-Latency-Breakdown.js** _(pending — available in webperf-interaction skill)_ 4. **Long-Animation-Frames.js** _(pending — available in webperf-interaction skill)_ 5. **Long-Animation-Frames-Script-Attribution.js** _(pending — available in webperf-interaction skill)_ ### Video as LCP Investigation When LCP is a video element (detected by LCP-Video-Candidate.js): 1. **LCP-Video-Candidate.js** - Identify video as LCP candidate 2. **Video-Element-Audit.js** (from Media skill) - Audit video loading strategy 3. **LCP-Subparts.js** - Analyze video loading phases 4. Cross-reference with **webperf-loading** skill: - Resource-Hints-Validation.js (check for video preload) - Priority-Hints-Audit.js (check for fetchpriority on video) ### Image as LCP Investigation When LCP is an image (most common case): 1. **LCP.js** - Measure LCP timing 2. **LCP-Subparts.js** - Break down timing phases 3. **LCP-Image-Entropy.js** - Analyze image complexity 4. Cross-reference with **webperf-media** skill: - Image-Element-Audit.js (check format, dimensions, lazy loading) 5. Cross-reference with **webperf-loading** skill: - Find-Above-The-Fold-Lazy-Loaded-Images.js (check if incorrectly lazy) - Priority-Hints-Audit.js (check for fetchpriority="high") - Resource-Hints-Validation.js (check for preload) ## Decision Tree Use this decision tree to automatically run follow-up snippets based on results: ### After LCP.js - **If LCP > 2.5s** → Run **LCP-Subparts.js** to diagnose which phase is slow - **If LCP > 4.0s (poor)** → Run full LCP deep dive workflow (5 snippets) - **If LCP candidate is an image** → Run **LCP-Image-Entropy.js** and **webperf-media:Image-Element-Audit.js** - **If LCP candidate is a video** → Run **LCP-Video-Candidate.js** and **webperf-media:Video-Element-Audit.js** - **Always run** → **LCP-Trail.js** to understand candidate evolution ### After LCP-Subparts.js - **If TTFB phase > 600ms**
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 08f0038
git clone https://github.com/nucliweb/webperf-snippets.git npm install claude mcp add webperf -- npx -y webperf-snippets mcp npx skills add nucliweb/webperf-snippets
git clone https://github.com/nucliweb/webperf-snippets git -C webperf-snippets checkout 08f0038bb80f
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 08f0038bb80f only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Claude Desktop | Mentioned in its text, not tested | Skills for Claude Desktop · About Claude Desktop |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
| Gemini CLI | Mentioned in its text, not tested | Skills for Gemini CLI · About Gemini CLI |
Audit history
Every audit, every source change
- !CAUTION C 78 / 100
first audit · source
08f0038bb80f
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/nucliweb/webperf-snippets/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
n8n-io/n8n
Reproduce a bug from a Linear ticket with a failing test. Expects the full ticket context (title, description, comments) to be provided as input.
n8n-io/n8n
Creates GitHub pull requests with properly formatted titles that pass the check-pr-title CI validation. Use when creating PRs, submitting changes for review, or when the user says /pr or asks to create a pull request.
google-gemini/gemini-cli
Use this skill when asked to review text and user-facing strings within the codebase. It ensures that these strings follow rules on clarity, usefulness, brevity and style.
google-gemini/gemini-cli
Use this skill during code reviews to proactively investigate the codebase for duplicated functionality, reinvented wheels, or failure to reuse existing project best practices and shared utilities.
google-gemini/gemini-cli
An open-source AI agent that brings the power of Gemini directly into your terminal.
google-gemini/gemini-cli
Use this skill if the user asks you to help them address GitHub PR comments for their current branch of the Gemini CLI. Requires `gh` CLI tool.
Add this badge to your README
[](https://modelsatlas.com/skills/nucliweb/webperf-snippets/)
<a href="https://modelsatlas.com/skills/nucliweb/webperf-snippets/"><img src="https://modelsatlas.com/skills/nucliweb/webperf-snippets/badge.svg" alt="ModelsAtlas: CAUTION C"></a>
Questions about webperf-snippets
What does the webperf-snippets skill do?
Is webperf-snippets safe to install?
What can webperf-snippets access on my machine?
Which assistants does webperf-snippets work with?
How current is this page?
Sources
- github.com/nucliweb/webperf-snippets — the audited source at commit 08f0038bb80f and every finding aboveObserved · 21 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the webperf-snippets skill do?
- Is webperf-snippets safe to install?
- What can webperf-snippets access on my machine?