seo-growth-workspace
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's scripts (gsc-fetch.mjs, gsc-oauth.mjs) perform network requests to official Google APIs for Search Console data retrieval and OAuth authentication. It also references external SEO tools like Ahrefs and the author's own SuperaSEO service for integration purposes.
- [COMMAND_EXECUTION]: The workspace is managed through a suite of dependency-free Node.js scripts that perform filesystem operations (reading/writing JSON state and Markdown reports) within the .seo/ directory.
- [CREDENTIALS_UNSAFE]: The skill handles sensitive API credentials for search engines and third-party tools. It implements security best practices by recommending the use of environment variables and storing local tokens using restricted filesystem permissions (0600) to prevent unauthorized access.
- [PROMPT_INJECTION]: The skill ingests data from external sources including Search Console queries, competitor website content, and community forum discussions (e.g., Reddit). This creates a surface for indirect prompt injection; however, the risk is classified as low as the data is used for quantitative analysis and reporting rather than being executed or used to override agent instructions.
Audit Metadata