blog-seo-check
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
GrepandGlobtools to scan the local project environment to verify bidirectional linking between blog posts. It also executes a local Python script (skills/blog-google/scripts/run.py) to perform credential checks and PageSpeed analysis. - [EXTERNAL_DOWNLOADS]: The skill allows fetching content from user-provided URLs. It specifies robust security constraints for these network operations, including protocol whitelisting (HTTP/HTTPS only), blocking of private/reserved IP ranges (SSRF protection), redirect limits, and response size capping.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external files and URLs for analysis. It mitigates potential prompt injection risks by explicitly instructing the agent to treat all fetched text as untrusted data and utilizing specific validation logic.
- [DYNAMIC_EXECUTION]: The skill initiates the execution of a Python-based utility script to interface with Google APIs for performance metrics. This script is part of the skill's local environment and is used for specific, scoped tasks.
Audit Metadata