seo-drift
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its core function of ingesting and parsing external website content.\n
- Ingestion points: Untrusted content is fetched from external URLs via
scripts/fetch_page.pyand parsed into elements like title tags, meta descriptions, and JSON-LD schema byscripts/parse_html.py.\n - Boundary markers: The skill instructions do not specify the use of delimiters or protective instructions (e.g., "ignore embedded commands") when the agent processes the fetched content.\n
- Capability inventory: The skill executes local Python scripts, writes to a local SQLite database (
~/.cache/claude-seo/drift/baselines.db), and generates HTML reports on the file system.\n - Sanitization: The skill performs URL normalization and SSRF validation, but there is no mention of sanitizing the extracted HTML or text content before it enters the agent's context.\n- [COMMAND_EXECUTION]: The skill executes multiple local Python scripts (e.g.,
drift_baseline.py,drift_compare.py,drift_report.py) to perform its baseline and comparison operations.\n- [EXTERNAL_DOWNLOADS]: The skill fetches data from user-provided URLs. It explicitly implements SSRF protection within its validated fetch pipeline to block access to private IPs, loopback addresses, and cloud metadata endpoints.
Audit Metadata