seo

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates its functionality by invoking several local Python scripts within a scripts/ directory. Notable examples include google_auth.py and backlinks_auth.py for credential verification, drift_history.py for tracking changes, and google_report.py for generating PDF documents. These scripts are integral to the skill's primary purpose of providing professional SEO reports.
  • [EXTERNAL_DOWNLOADS]: The skill connects to numerous reputable third-party services and APIs to retrieve SEO data. This includes Google APIs (PageSpeed Insights, Search Console, CrUX), Moz, Bing Webmaster Tools, DataForSEO, and OpenStreetMap's Overpass API. These connections are documented as necessary for the skill's data-driven analysis.
  • [PROMPT_INJECTION]: The skill is designed to ingest and analyze content from arbitrary URLs provided by the user. This creates a surface for indirect prompt injection, as the agent processes untrusted data from external websites.
  • Ingestion points: Data is ingested via the fetch_page.py and parse_html.py scripts which crawl the user-specified URL.
  • Boundary markers: None are explicitly defined in the provided instructions to delimit the untrusted website content from the analysis instructions.
  • Capability inventory: The skill has the ability to execute local scripts, perform network requests to SEO APIs, and generate output files (PDF reports).
  • Sanitization: The provided reference files do not detail specific sanitization or filtering logic applied to the crawled HTML content before it is analyzed by the subagents.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 05:54 AM