The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a central runner (scripts/run.py) to execute its various modules. It includes explicit security checks using pathlib.Path.relative_to to ensure that requested script names do not escape the designated scripts directory.
[DATA_EXPOSURE]: The skill manages Google API credentials (API keys, service account JSONs, and OAuth tokens) in the user's home directory (~/.config/claude-seo/). It uses atomic write operations and sets restrictive filesystem permissions (0o600) to protect these secrets from other users on the system.
[EXTERNAL_DOWNLOADS]: The skill interacts with well-known Google API endpoints (e.g., googleapis.com, chromeuxreport.googleapis.com) and fetches content from user-provided URLs for NLP analysis. These interactions are legitimate for the skill's purpose and include protections against SSRF in scripts/nlp_analyze.py by blocking internal and loopback IP addresses.
[REMOTE_CODE_EXECUTION]: The skill manages its own virtual environment through scripts/setup_environment.py. It uses pip with a lock file (requirements.lock) that enforces SHA-256 hash verification for all dependencies, mitigating the risk of supply-chain attacks.
[INDIRECT_PROMPT_INJECTION]: As the skill fetches and processes content from external websites (for NLP analysis) and batch URL files, it has a surface for indirect prompt injection. However, this risk is localized to the data processing scripts which perform sanitization (e.g., stripping HTML tags) and treat the data as content to be analyzed rather than instructions to be followed.

blog-google