The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Documentation in README.md and wiki/Installation.md repeatedly instructs users and agents to execute remote code using the curl -fsSL ... | bash pattern. This pattern fetches the install.sh script directly from GitHub and executes it without prior verification or checksum validation.
[COMMAND_EXECUTION]: Multiple scripts within the scripts/ directory utilize the Python subprocess module to execute system-level commands. Specifically:
github_api.py and github_repo_audit.py execute git and gh commands.
lighthouse_runner.py executes the lighthouse or npx CLI tools.
github_seo_report.py and generate_report.py orchestrate and execute other Python scripts in the repository via subprocess.run.
[DYNAMIC_EXECUTION]: The skill architecture relies on the AI agent dynamically executing nearly 90 different Python scripts to perform its SEO analysis tasks. This extensive local code execution capability increases the risk of exploitation if any script contains vulnerabilities or if the agent is manipulated via prompt injection.
[EXTERNAL_DOWNLOADS]: The installation scripts (install.sh and install.ps1) include an --online mode that programmatically downloads release archives (ZIP/Tarball) from GitHub using curl or Invoke-WebRequest and extracts them directly to the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant exposure surface for indirect prompt injection attacks:
Ingestion points: Scripts like fetch_page.py, article_seo.py, and crawl_audit.py fetch and parse raw HTML content from arbitrary external URLs.
Boundary markers: The skill lacks explicit instructions or delimiters to treat the content of these external pages as untrusted, increasing the likelihood that the AI agent might follow instructions embedded within the analyzed SEO data.
Capability inventory: The agent has the ability to execute 89 different scripts, perform network requests, and execute shell commands (git, gh).
Sanitization: While network-level SSRF protection is implemented in scripts/lib/safe_http.py, there is no semantic sanitization of the fetched HTML content before it is processed by the agent's LLM context.

seo