page-play-builder
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill references a local Python utility,
indexpush.py, stored within the plugin's root directory. This script is used to submit new URLs to search engine indexing services like Bing and Baidu. This is a functional requirement for programmatic SEO and is gated by quality guardrails defined within the skill. - [PROMPT_INJECTION]: The skill is designed to ingest and summarize external data from third-party platforms and competitor websites. To protect against indirect prompt injection, the instructions include a mandatory directive to treat all fetched or pasted content as untrusted input and to ignore any instructions embedded within that content.
- [DATA_EXFILTRATION]: The skill transmits page URLs to well-known search engine indexing APIs. It manages sensitive information, such as indexing keys and tokens, via environment variables or user input for the indexing script, ensuring that credentials are not hardcoded or exposed in the skill instructions.
Audit Metadata