seo-audit-full
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches raw HTML content from external URLs (via
fetch-page.py) to perform semantic SEO analysis. This introduces a surface where malicious instructions embedded in the audited website's content could attempt to influence the agent's behavior during the review phase. - Ingestion points: External web content is fetched into the agent's context from target URLs.
- Boundary markers: The instructions lack explicit delimiters or 'ignore embedded instructions' warnings when processing raw HTML data.
- Capability inventory: The skill can execute shell commands for script execution and file opening.
- Sanitization: Scripts like
check-page.pyuse basic HTML parsing to extract specific tags, butfetch-page.pyretrieves the full page body. - [COMMAND_EXECUTION]: The skill workflow involves executing local Python scripts in the
scripts/directory. It also uses theopencommand to display generated HTML reports to the user upon confirmation. - [EXTERNAL_DOWNLOADS]: The skill interacts with the official Google PageSpeed Insights API (
googleapis.com) to retrieve performance data. This is a well-known service required for the skill's primary functionality.
Audit Metadata