skills/gsfsss/claude-seo/seo-sitemap/Gen Agent Trust Hub

seo-sitemap

Pass

Audited by Gen Agent Trust Hub on Aug 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes a shell command using claude-seo run sitemap_discovery.py <url> --json to perform sitemap discovery. This pattern takes user-provided URL input and passes it to a subprocess execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could be manipulated to influence agent behavior.
  • Ingestion points: External robots.txt files and XML sitemaps are retrieved and parsed in SKILL.md (Mode 1).
  • Boundary markers: The instructions do not define delimiters or specific "ignore instructions" warnings for the data fetched from external domains.
  • Capability inventory: The skill has the capability to execute shell commands (claude-seo), read from sibling directories (../seo-plan/assets/), and write files to the working directory (sitemap.xml, VALIDATION-REPORT.md, STRUCTURE.md).
  • Sanitization: The skill documentation references a 'shared SSRF-safe fetch layer' to manage cross-host targets, which acts as a mitigation against server-side request forgery.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves sitemap files and robots.txt declarations from remote URLs provided during the analysis process.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 29, 2026, 01:16 PM