serp-markup-builder
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting untrusted data from external URLs.
- Ingestion points: Content is retrieved from user-provided URLs using the WebFetch tool, as described in SKILL.md (Data Sources section).
- Boundary markers: Absent. While SKILL.md contains a prompt-level instruction to treat fetched content as untrusted, no technical delimiters (e.g., XML tags or specific markers) are used to isolate the external data from the agent's instructions.
- Capability inventory: The skill can execute shell commands (python3 in SKILL.md) and write files to the local file system (memory/content/ in SKILL.md).
- Sanitization: Absent. There is no evidence of programmatic sanitization, filtering, or validation of the fetched HTML or JSON-LD content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill invokes a Python script via the shell to perform schema validation tasks.
- Evidence: The instructions in SKILL.md direct the agent to run python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connectors/schema_lint.py" . The script is a vendor-provided resource intended for automated pre-flight checks.
- [DATA_EXFILTRATION]: The skill performs network operations to retrieve data from external sources.
- Evidence: The skill uses the WebFetch tool to access remote URLs for metadata extraction and schema validation, as documented in SKILL.md.
Audit Metadata