The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests content from external websites (crawling up to 500 pages) which is then analyzed by specialized sub-agents. A malicious website could embed instructions designed to trick the agent into reporting false information or ignoring specific issues.
Ingestion points: Raw HTML, rendered HTML, and extracted text captured from audited URLs in SKILL.md.
Boundary markers: The skill does not specify the use of delimiters or 'ignore' instructions when passing crawled web content to the sub-specialist agents.
Capability inventory: The skill executes Python scripts for rendering, reporting, and credential checking, and performs file-write operations to the {domain}-audit/ directory.
Sanitization: There is no explicit requirement for the sanitization of crawled text or HTML before it is processed by the AI subagents.
[COMMAND_EXECUTION]: The skill relies on a script runner to execute various Python utilities located in the plugin's directory.
Evidence: Calls to "${CLAUDE_PLUGIN_ROOT}/scripts/claude-seo" run execute scripts such as render_page.py, google_report.py, and drift_history.py using parameters derived from the user-supplied URL and the detected domain name.
Risk: While the scripts are local to the skill, passing untrusted web data (like a domain name) as a command-line argument requires robust internal sanitization within those scripts to prevent command injection.

seo-audit