seo-ai-discovery
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sites (e.g., /llms.txt, /agents.md, /.well-known/ucp) stored in discovery.json. This ingestion creates a potential surface for indirect prompt injection.
- Ingestion points: External file content is loaded from <run_dir>/site/discovery.json (SKILL.md).
- Boundary markers: The instructions do not define specific prompt delimiters for the ingested content, though specialized scripts are used for processing.
- Capability inventory: The skill uses Bash to execute Node.js scripts, and has access to Read, Grep, and Glob tools.
- Sanitization: The skill employs specific validators like dom_assert, schema_validator, and xml_parse within its scripts to check data integrity.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run local scripts (snapshot.mjs, ai-discovery.mjs) located in ${CLAUDE_PLUGIN_ROOT}. These scripts handle the data collection and validation logic for the audit.
- [EXTERNAL_DOWNLOADS]: The skill probes various discovery files and agent endpoints on target sites to perform its audit. This involves network requests to external domains to collect metadata and structured files for analysis.
Audit Metadata