seo-performance
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external URLs, which could contain malicious instructions designed to influence the agent. * Ingestion points: User-supplied target URL. * Boundary markers: Not specified. * Capability inventory: Shell command execution, local script invocation, and file system writes. * Sanitization: None described.
- [COMMAND_EXECUTION]: The skill uses shell commands for directory management and script execution. * Evidence: Executes mkdir with a {url-slug} variable, which may be vulnerable to injection or path traversal if not properly validated. * Evidence: Uses grep and echo to modify the .gitignore file. * Evidence: Runs a local python script scripts/analyze_performance.py.
- [EXTERNAL_DOWNLOADS]: The skill fetches data from well-known performance services. * Evidence: Utilizes PageSpeed Insights and CrUX APIs.
- [DATA_EXFILTRATION]: The skill reads files from parent directory paths to generate reports. * Evidence: Accesses templates and standards from ../seo-audit/ and ../seo/references/ folders.
Audit Metadata