seo-sxo
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/fetch_page.pyperforms network requests to fetch external HTTP/HTTPS content. It implements security validations to prevent Server-Side Request Forgery (SSRF) by ensuring that IP addresses are global and blocking URLs that contain embedded credentials. - [EXTERNAL_DOWNLOADS]: The
scripts/generate_pdf_report.pyscript suggests the installation of thereportlablibrary viapipif it is not already available on the system. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external web pages, which is a potential vector for indirect prompt injection.
- Ingestion points:
scripts/fetch_page.pyretrieves HTML content from external URLs. - Boundary markers:
SKILL.mdcontains explicit instructions to treat scraped text and third-party exports as untrusted and to ignore any instructions found within that evidence. - Capability inventory: The skill has the ability to perform network requests (
scripts/fetch_page.py) and write files to the local file system (scripts/generate_markdown_report.py,scripts/generate_pdf_report.py,scripts/schema_generator.py). - Sanitization:
scripts/fetch_page.pyuses regex and HTML unescaping to clean extracted text before it is presented to the agent. - [DYNAMIC_EXECUTION]: Several utility scripts (
scripts/generate_markdown_report.py,scripts/schema_generator.py) read and write files based on user-supplied paths and perform dynamic data manipulation, such as filling JSON-LD templates.
Audit Metadata