webperf-snippets
Tested JavaScript snippets that measure and debug web performance. Your AI agent runs them for you, or you run them yourself in DevTools: the same code every time.
No outside reports on file
These snippets are regular JavaScript with no built-in protection, so only run them on pages you trust and review the code before use.
Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachFetches arbitrary web URLsREVIEW
- CredentialsRequires API key or tokenREVIEW
- Package sourceGitHub (nucliweb/webperf-snippets)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/nucliweb/webperf-snippets ↗
About Webperf Snippets
This is a collection of ready-to-use JavaScript code snippets that measure how fast web pages load and run. You can paste them into your browser's developer tools, or an AI agent can run them for you to get consistent performance data every time.
Who it’s for
Web developers and performance engineers who want quick, repeatable ways to check page speed, memory use, and other metrics. Teams that want the same testing code run the same way across different people and times.
Alternatives
- Lighthouse (built into Chrome DevTools): Browser-native performance auditing with no extra code needed
- WebPageTest: Online tool for detailed performance testing and waterfall charts
- SpeedCurve: Commercial service for continuous performance monitoring
- User Timing API / PerformanceObserver: Native browser APIs for custom performance measurement
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README. You can view the snippets on GitHub at the link provided, copy them into your browser's console or DevTools, or integrate them into your own testing workflow.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.5k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Runs in page context: Code executes with full access to the page's data, cookies, and local storage; a malicious snippet could steal user credentials or session tokens
- No sandbox protection: Snippets run as regular JavaScript with no isolation; they can read any data the page can see
- Social engineering via code: Attackers could add hidden logic to snippets that looks legitimate but steals metrics data or page content
- Unverified updates: If fetched from untrusted sources, snippets may be swapped with malicious versions without warning
- Data exposure in results: Performance metrics might leak URLs, user counts, or internal system details if not handled carefully
How to lower the risk
Least-privilege permissions
- Run snippets only on pages you own or fully control
- Never paste snippets from unknown sources into production sites
Network isolation
- Keep snippets local; do not send raw results to untrusted endpoints
- Sanitize any output before logging or sharing it
Monitoring
- Review snippet code before each use to spot hidden malicious logic
- Log which snippets ran and when for audit trails
Red flags to watch for
- Snippets that make network requests or modify page content
- Code that accesses cookies, localStorage, or sessionStorage
- Requests to run snippets from unofficial or anonymized sources
Questions
How do I install Webperf Snippets?
Webperf Snippets does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/nucliweb/webperf-snippets.
Are there security reports about Webperf Snippets?
No reports found for this package in our research (last checked 2026-10-29). Webperf Snippets currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include runs in page context, no sandbox protection, social engineering via code.
Is Webperf Snippets actively maintained?
Webperf Snippets has 1.5k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/nucliweb/webperf-snippets before pinning it in production.
What are alternatives to Webperf Snippets?
Notable alternatives to Webperf Snippets include Lighthouse (built into Chrome DevTools) (Browser-native performance review with no extra code needed), WebPageTest (Online tool for detailed performance testing and waterfall charts), SpeedCurve (Commercial service for continuous performance monitoring), User Timing API / PerformanceObserver (Native browser APIs for custom performance measurement). You can also compare Webperf Snippets side by side with other skills in the Related tools section on this page.
README badge and team notes
Maintain or use Webperf Snippets? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/nucliweb-webperf-snippets)HTML embed:
<a href="https://agentarmorhq.com/skills/nucliweb-webperf-snippets"><img src="https://agentarmorhq.com/api/badge/nucliweb-webperf-snippets" alt="AgentArmorHQ Risk Grade for Webperf Snippets" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "nucliweb-webperf-snippets"Share with your security lead
Need sign-off to use webperf-snippets? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: webperf-snippets
- **Listing URL:** https://agentarmorhq.com/skills/nucliweb-webperf-snippets
- **Type:** AI agent skill
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.5k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** Requires API key or token
- **Package source:** GitHub (nucliweb/webperf-snippets)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/nucliweb/webperf-snippets
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- nucliweb
- Source code
- github.com/nucliweb/webperf-snippets
- Est. context load
- ~69 tokens idle · ~450 tokens when active (on-demand skill)
- Popularity
- 1.5k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-22
Community
Discussions for Webperf Snippets
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude