blog-seo-check
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script located in a sibling directory to perform SEO and performance checks. It passes user-provided data, specifically URLs, as arguments to this script via the command line. Evidence:
python3 "$BLOG_SKILLS_DIR/blog-google/scripts/run.py" pagespeed_check '<url>' --jsonfound in the optional performance check section. - [EXTERNAL_DOWNLOADS]: The skill facilitates fetching data from external web addresses provided by the user or found within blog posts to perform link audits and PageSpeed validations. Evidence: Detailed URL safety check logic in Step 1 and link verification in Step 6.
- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes untrusted data from blog posts, metadata, and external websites, which serves as a potential vector for indirect prompt injection.
- Ingestion points: Target blog files and external web pages (Step 1).
- Boundary markers: The skill explicitly directs the agent to treat fetched data as untrusted and to ignore instructions contained within (Workflow section).
- Capability inventory: Local file access, network requests, and shell execution (python3).
- Sanitization: Implementation of URL safety checks to prevent SSRF and access to restricted IP ranges.
Audit Metadata