The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to clone a repository from GitHub (https://github.com/fortunto2/seo-cli.git) and install it using uv pip install -e .. The agent is then instructed to execute the resulting cli.py script to perform audits. This represents the execution of remote code fetched at runtime from a source that is not verified or trusted.
[EXTERNAL_DOWNLOADS]: The skill fetches external code and tools from GitHub and NPM (via npx lighthouse). While these are well-known platforms, the specific repository used for the primary audit functionality (fortunto2/seo-cli) is not an established trusted source.
[COMMAND_EXECUTION]: The skill interpolates user-supplied arguments, such as URLs or project names, directly into shell commands. Examples include python ~/startups/shared/seo-cli/cli.py audit <url> and npx lighthouse {url} --output=json. If a user provides an input containing shell metacharacters (e.g., ; rm -rf /), it could lead to arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites and infrastructure files, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill fetches and parses HTML content, Open Graph tags, JSON-LD data, sitemap.xml, and robots.txt from external URLs provided in $ARGUMENTS (SKILL.md).
Boundary markers: The instructions lack delimiters or explicit warnings to the agent to treat the fetched content strictly as data rather than instructions.
Capability inventory: The skill has access to sensitive tools including Bash (for running the CLI and Lighthouse), Write (for modifying files in the local filesystem), and WebFetch (SKILL.md).
Sanitization: There is no evidence of sanitization or validation performed on the fetched external content before it is used to generate reports or summarized.

solo-seo-audit