seo-agent-readiness
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute Node.js scripts (snapshot.mjs,agent-readiness.mjs) and the Lighthouse CLI for page auditing. - [EXTERNAL_DOWNLOADS]: The skill invokes
npx lighthouse, which fetches content from external URLs for auditing purposes and may download package updates from official registries. The documentation notes that this is a consent-gated operation requiring user agreement. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from web page snapshots to identify SEO and accessibility issues.
- Ingestion points: The skill reads
pages/<slug>.jsonandpages/<slug>.htmlfiles containing external web content (SKILL.md). - Boundary markers: Findings are required to conform to
schema/finding.schema.json, providing a structured output format that limits the influence of processed data. - Capability inventory: The skill uses
Read,Grep, andBash(to runnodeandnpx). - Sanitization: The instructions direct the agent to quote observed elements verbatim as evidence within the JSON schema, which helps isolate untrusted content from the agent's logic.
Audit Metadata