From 6045554bce1c36f4f49b7c9a207c4c4ff5e3d14a Mon Sep 17 00:00:00 2001 From: orbisai0security Date: Tue, 7 Jul 2026 00:34:38 +0000 Subject: [PATCH] fix: V-002 security vulnerability Automated security fix generated by OrbisAI Security --- commands/webperf.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/commands/webperf.toml b/commands/webperf.toml index 62b11bcd..3532ec69 100644 --- a/commands/webperf.toml +++ b/commands/webperf.toml @@ -8,7 +8,7 @@ prompt = """ Deep mode — activate when any of these is available: - A Lighthouse JSON report file (e.g. `npx lighthouse --output json --output-path ./report.json`, or `npx -p chrome-devtools-mcp chrome-devtools lighthouse_audit --output-format=json` from the Chrome DevTools MCP CLI) - A PageSpeed Insights JSON response (includes Lighthouse + CrUX) -- A CrUX API response (requires CRUX_API_KEY or GOOGLE_API_KEY) +- A CrUX API response (requires $CRUX_API_KEY or $GOOGLE_API_KEY environment variables — never hard-code these values in config files) - A DevTools performance trace - A live URL plus the chrome-devtools MCP server configured in the harness (capture metrics directly via lighthouse_audit and performance_* tools) - The Chrome DevTools MCP CLI invoked locally (via `npx -p chrome-devtools-mcp chrome-devtools `), passing the JSON output to the agent