seo-unlighthouse
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation specifies a dependency on the
unlighthousenpm package and mentions a local installation script (extensions/unlighthouse/install.sh) to set up the environment. - [PROMPT_INJECTION]: The skill audits external websites and parses the resulting
ci-result.jsonfile into the agent's context, creating a potential surface for indirect prompt injection. - Ingestion points: The
ci-result.jsonfile, which contains performance and SEO data harvested from external URLs. - Boundary markers: No specific delimiters or warnings for the agent to ignore embedded instructions are mentioned in the documentation.
- Capability inventory: The skill uses
scripts/unlighthouse_run.pyto execute subprocesses and write audit reports to local directories. - Sanitization: The skill documentation notes that user-provided URLs undergo a
url_safetypre-flight check before processing.
Audit Metadata