seo-sxo

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/fetch_page.py performs network requests to fetch external HTTP/HTTPS content. It implements security validations to prevent Server-Side Request Forgery (SSRF) by ensuring that IP addresses are global and blocking URLs that contain embedded credentials.
  • [EXTERNAL_DOWNLOADS]: The scripts/generate_pdf_report.py script suggests the installation of the reportlab library via pip if it is not already available on the system.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external web pages, which is a potential vector for indirect prompt injection.
  • Ingestion points: scripts/fetch_page.py retrieves HTML content from external URLs.
  • Boundary markers: SKILL.md contains explicit instructions to treat scraped text and third-party exports as untrusted and to ignore any instructions found within that evidence.
  • Capability inventory: The skill has the ability to perform network requests (scripts/fetch_page.py) and write files to the local file system (scripts/generate_markdown_report.py, scripts/generate_pdf_report.py, scripts/schema_generator.py).
  • Sanitization: scripts/fetch_page.py uses regex and HTML unescaping to clean extracted text before it is presented to the agent.
  • [DYNAMIC_EXECUTION]: Several utility scripts (scripts/generate_markdown_report.py, scripts/schema_generator.py) read and write files based on user-supplied paths and perform dynamic data manipulation, such as filling JSON-LD templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:47 PM