technical-seo-checker
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The script
scripts/fetch_page.pyperforms network operations to external URLs provided at runtime. While it includes SSRF protection by blocking private IP ranges, it allows connections to arbitrary public domains. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external websites, creating a vulnerability surface where malicious instructions embedded in a web page could influence the agent's behavior.
- Ingestion points:
scripts/fetch_page.pyfetches content from external URLs. - Boundary markers:
SKILL.mdincludes a specific warning in the "Data Sources" section to treat scraped material as untrusted and ignore embedded instructions. - Capability inventory: The skill includes several scripts (
generate_markdown_report.py,generate_pdf_report.py, andschema_generator.py) that can write files to the local filesystem. - Sanitization: Data is extracted using regular expressions for specific HTML tags rather than full rendering, reducing the risk of automatic instruction execution.
Audit Metadata