seo-meta-onpage
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data (rendered_dom or raw_html) from websites, creating an indirect prompt injection surface where malicious web content could attempt to influence the agent's analysis or generated SEO fixes.
- Ingestion points: The skill ingests raw HTML or rendered DOM content from external URLs as specified in SKILL.md.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the processing logic.
- Capability inventory: The skill utilizes Bash and executes local scripts (parse-html.mjs) for verification, and it can perform file writes to apply SEO fixes.
- Sanitization: There is no evidence of sanitization or validation of the ingested HTML content before processing.
- [COMMAND_EXECUTION]: The skill executes a local Node.js utility script for verification purposes.
- Evidence: Uses the command 'node ${CLAUDE_SKILL_DIR}/../../scripts/parse-html.mjs' to audit page elements as documented in the Verification section of SKILL.md.
Audit Metadata