seo-competitor-pages
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external competitor URLs and a shared local cache (
.seo-cache/), which introduces an attack surface for indirect prompt injection. Malicious instructions embedded in competitor websites could potentially influence the agent's output during the generation of comparison pages. - Ingestion points: External competitor URLs (as specified in
argument-hint) and cached data files (site-meta.json,page-analysis.json) referenced inSKILL.md. - Boundary markers: The skill does not explicitly define delimiters or provide "ignore embedded instructions" warnings for the external content it ingests.
- Capability inventory: The skill instructions permit file writing (
.seo-cache/updates,COMPARISON-PAGE.mdgeneration) and network access for crawling competitors. - Sanitization: The skill relies on "Fairness Guidelines" for content quality but does not implement technical sanitization or validation of the ingested external text to prevent prompt injection.
Audit Metadata