seo-agent-readiness

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute Node.js scripts (snapshot.mjs, agent-readiness.mjs) and the Lighthouse CLI for page auditing.
  • [EXTERNAL_DOWNLOADS]: The skill invokes npx lighthouse, which fetches content from external URLs for auditing purposes and may download package updates from official registries. The documentation notes that this is a consent-gated operation requiring user agreement.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from web page snapshots to identify SEO and accessibility issues.
  • Ingestion points: The skill reads pages/<slug>.json and pages/<slug>.html files containing external web content (SKILL.md).
  • Boundary markers: Findings are required to conform to schema/finding.schema.json, providing a structured output format that limits the influence of processed data.
  • Capability inventory: The skill uses Read, Grep, and Bash (to run node and npx).
  • Sanitization: The instructions direct the agent to quote observed elements verbatim as evidence within the JSON schema, which helps isolate untrusted content from the agent's logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 01:43 PM
Security Audit — agent-trust-hub — seo-agent-readiness