90-day-seo-sprint
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as
open,xdg-open,start, andcurlto interact with a Google Sheet and the Distribb API for SEO tasks. - [EXTERNAL_DOWNLOADS]: The agent is directed to access a specific Google Sheet at
https://docs.google.com/spreadsheets/d/1mBiXCNMymK0OTlptdO9QMa4IQbOHOycSLjt-joCL-wM/edit?usp=sharingto facilitate SEO sprint tracking. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it instructs the agent to read and interpret data from the Google Sheet (via
browser_snapshot) to determine the next steps in the SEO plan. - Ingestion points: Content of the Google Sheet tracker.
- Boundary markers: None present; the agent is instructed to read cells directly to coach the user.
- Capability inventory: Shell command execution (
curl,open) and API-driven content publication. - Sanitization: No explicit sanitization or validation of the spreadsheet content is mentioned.
Audit Metadata