lov-better-seo
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data such as metadata, sitemaps, and JSON-LD content, which could potentially contain adversarial instructions designed to subvert agent behavior.
- Ingestion points: Reads local Next.js project files including metadata components, robots.txt, and sitemap XML files.
- Boundary markers: The workflow defines clear separation between analysis, preview, and modification tasks, allowing for user review between steps.
- Capability inventory: The skill requires file system read/write access for analysis and fixing SEO issues, as well as CLI execution for project builds.
- Sanitization: Instructions mandate checking recommendations against official Next.js documentation and current project versions to ensure technical accuracy.
- [SAFE]: The configuration utility in
scripts/profile_store.pyincludes a security check that explicitly filters out sensitive terms such as 'token', 'secret', and 'password' from being persisted to the long-term user profile. - [SAFE]: The skill uses
PyYAMLfor configuration management, which is a standard industry dependency, and performs atomic file operations to ensure the integrity of its local storage. - [SAFE]: No remote code execution patterns, unauthorized network exfiltration, or obfuscated content were detected within the skill's scripts or instructions.
Audit Metadata