web-perf

An agent skill by cloudflare, from cloudflare/skills. Tags: analysis, lighthouse, performance, validation, web.

What it does

Audit, diagnose, or optimize website loading and interaction performance, Core Web Vitals, and Lighthouse performance scores.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cloudflare/skills --skill web-perf

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cloudflare/skills
cp -r skills/skills/web-perf ~/.claude/skills/web-perf

Safety box score

Grade B, low risk: 21 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a browser-based performance auditor: it loads pages, records traces, inspects network requests, and can read local project config for optimization advice. It does not ship destructive scripts, but it does drive a browser on arbitrary URLs and may touch local MCP configuration during setup.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It relies on browser/MCP tool actions such as `navigate_page(url: "...")` and `performance_start_trace(autoStop: true, reload: true)`, plus an example `npx -y chrome-devtools-mcp@latest` setup command.
Network access	1 (low)	It intentionally retrieves external docs (`https://web.dev/articles/vitals`, Chrome DevTools docs) and loads the audited target site, so network traffic to third-party hosts is inherent but bounded.
Filesystem reach	2 (moderate)	It reads local project files for codebase analysis (`package.json`, framework configs) and may change MCP configuration when setup is authorized: `Only change MCP configuration when setup is within the user's authorized scope`.
Secrets & credentials	0 (none)	The skill does not ask for API keys, passwords, tokens, `.env` files, keychains, or browser sessions.
Privilege & persistence	0 (none)	It does not require sudo, global installs, services, scheduled tasks, or OS/shell startup changes.
Instruction hijack surface	0 (none)	There is no instruction to ignore higher-priority rules, hide content, or follow untrusted remote instructions; the retrieval notes are about documentation lookup, not prompt injection.
Irreversible actions	1 (low)	It can autonomously drive the browser and run traces on the user's behalf (`navigate_page`, `performance_start_trace`), but it does not post, deploy, pay, or delete anything.
Transparency	1 (low)	There is no bundled binary or hidden code, but the setup example uses an unpinned package reference: `npx -y chrome-devtools-mcp@latest`.

Before installing

Read the MCP setup section and confirm you want the browser tools to be installed/used on your machine.
If you plan to use the Chrome DevTools MCP setup, prefer a pinned version instead of `@latest` and review the upstream install guide first.
Run the skill first against a non-sensitive test site or scratch project to confirm it only touches the intended browser/profile and files.

Rated 2026-10-21 by an automated review of 1 file from the skill's repository.

Source

Repository: cloudflare/skills (all skills from this repository)
Path: skills/web-perf/SKILL.md
Branch: main
Updated: 2026-09-20

seo-page — Deep single-page SEO analysis covering on-page elements, content quality, technical meta tags, schema, images, and performance.
principle-fix-root-causes — Apply when debugging.
seo — Comprehensive SEO analysis for any website or business type.
video-comparer — This skill should be used when comparing two videos to analyze compression results or quality differences.
aws-database — Routes any task involving AWS databases — choosing, comparing, recommending, getting started with.
blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.