write-seo
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several command-line tools to manage the Hugo site.
- Executes
hugo list allvia a Python subprocess inscripts/seo_posts.pyto identify published content. - Uses
git statusandgit logto identify recently changed files for processing. - Runs local Python scripts including
scripts/seo_posts.py,scripts/site-search, andarticle_status.pyfor mechanical checks and logging. - Performs a full site build to a temporary directory using
hugo --gc --minifyto verify that internal links resolve correctly. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data which could contain malicious instructions.
- Ingestion points: Reads blog post content (
index.md) and external prompt configuration files (seo-front-matter.md). - Boundary markers: Absent; the skill treats the content of these files as data to be processed or rules to be followed.
- Capability inventory: File system writes (editing posts), command execution (Hugo builds).
- Sanitization: None; the skill relies on the LLM's ability to distinguish between content and instructions.
- [EXTERNAL_DOWNLOADS]: The skill instructions mention downloading tools if they are missing.
- Recommends
brew install hugoandbrew install pythonfor environment setup. These are references to official software via a well-known package manager.
Audit Metadata