geo-audit
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill conducts a static analysis of project files to provide optimization recommendations for AI answer engines. Its operations are transparent and restricted to the project's working directory.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a theoretical attack surface for indirect prompt injection as it processes untrusted user content (e.g., website source code, markdown files) to generate audit findings.
- Ingestion points: Project source files are analyzed via glob and read operations in Step 5.
- Boundary markers: None explicitly defined within the skill instructions.
- Capability inventory: The skill has file-write permissions for report generation and utilizes authorized MCP tool calls.
- Sanitization: None specified for input content; reliance on the LLM's inherent processing safety.
- [EXTERNAL_DOWNLOADS]: The skill instructions provide a command for the user to install the
@upstash/context7-mcptool. Upstash is a well-known technology provider, and the reference is for optional feature enhancement. - [COMMAND_EXECUTION]: The skill interacts with the platform's Model Context Protocol (MCP) by invoking
mcp__claude_ai_Context7__resolve-library-id. This is a legitimate use of the platform's tool-calling capabilities to access updated documentation.
Audit Metadata