Why this verdict
- suspicious: finding skill:skills/webpagetest:skills/webpagetest/references/rule.md:321:EXEC
- suspicious: finding skill:skills/webpagetest:skills/webpagetest/references/rule.md:451:EXEC
- suspicious: finding skill:skills/webpagetest:skills/webpagetest/references/rule.md:455:SUPPLY
- suspicious: finding skill:skills/webpagetest:skills/webpagetest/references/rule.md:511:EXEC
Security findings 4
Code execution
highContextual riskmedium confidenceBoth the webpack plugin and the express dashboard examples require('./webpagetest-analyzer'), a module the artifact does not ship, so loading them executes whatever file exists at that path at runtime.
const WebPageTestAnalyzer = require('./webpagetest-analyzer')vector:instruction
Counter-argument considered
The require of an unshipped module appears verbatim in the skill's referenced rule.md and is constructed and invoked inside the webpack afterEmit hook, giving a concrete source-to-execution chain; the skill declares no claims, the behavior matches no carve-out, and the module being absent from the artifact never neutralizes the instruction.
Code execution
highContextual riskmedium confidenceThe shipped GitHub Actions example instructs running 'node scripts/webpagetest-runner.js', a script the artifact does not ship, so following it executes whatever file exists at that path at runtime.
node scripts/webpagetest-runner.js https://staging.your-site.com
vector:instruction
Counter-argument considered
The workflow's run block concretely instructs executing scripts/webpagetest-runner.js, content the artifact does not fix, so the runtime resolves whatever exists at that path; no declaration or carve-out covers this, and absence of the file does not make the run instruction harmless or chain-free.
Code execution
highContextual riskmedium confidenceThe shipped performance-budget CI example instructs running 'node scripts/check-performance-budget.js', a script the artifact does not ship, so following it executes whatever file exists at that path at runtime.
node scripts/check-performance-budget.js
vector:instruction
Counter-argument considered
The performance-budget job's run block concretely instructs executing scripts/check-performance-budget.js, content the artifact does not ship or fix, creating a runtime execution chain; the skill declares no claims and no carve-out covers running arbitrary local scripts, and the file's absence never neutralizes the instruction.
Supply chain
mediumContextual risklow confidenceThe documented GitHub Actions workflow instructs CI to globally install the webpagetest npm client without a version pin, executing whatever version the registry serves at run time.
npm install -g webpagetest
vector:instruction
Counter-argument considered
The CI instruction installs the webpagetest client globally with no version pin, so the pinned official-registry install carve-out does not apply and the registry serves arbitrary versions at run time; the skill declares no claims covering this install, so the finding survives.
Open questions 6
What the analysis could not settle from the code alone.
[file request skills/webpagetest/scripts/webpagetest-runner.js] The shipped GitHub Actions example invokes 'node scripts/webpagetest-runner.js https://staging.your-site.com'. Does this script exist in the artifact, and if so what does it execute, read, or send off-host?
Code execution
[file request skills/webpagetest/scripts/check-performance-budget.js] The shipped GitHub Actions example invokes 'node scripts/check-performance-budget.js' with LCP_BUDGET/FCP_BUDGET/CLS_BUDGET env vars. Does this script exist in the artifact, and if so what does it execute, read, or send off-host?
Code execution
[file request skills/webpagetest/references/webpagetest-analyzer.js] Two shipped examples require('./webpagetest-analyzer') (the webpack plugin and the express dashboard, the latter importing it as a named export that does not match the default export of the shown webpagetest-api.js). Does this module exist in the artifact, and if so what does it do?
Code execution
[file request skills/webpagetest/references/webpagetest-analyzer.js] Is this module, required by the webpack plugin and dashboard examples but never shown (the doc defines webpagetest-api.js instead), shipped by the artifact, and if so does it perform any network send of local data, credential access beyond the WebPageTest API key, or execution of fetched code?
Data exfiltration
[file request scripts/webpagetest-runner.js] Does the artifact ship this script invoked by the documented GitHub Actions workflow, and if so does it send anything beyond the target URL to webpagetest.org?
Data exfiltration
[file request scripts/check-performance-budget.js] Does the artifact ship this script invoked by the documented performance-budget CI step, and if so what files, environment variables, or network destinations does it touch?
Code execution
Coverage gaps 4
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
apps/web/public/projects/indie-dev-toolkit/indie-dev-toolkit.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/audits/2026-10-04-mcp-validation/assets/checklist-interaction.webm
context:unanalyzable_binary binary content is only byte-scanned
docs/audits/2026-10-04-mcp-validation/assets/mcp-tab-interaction.webm
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml
