yoast-seo
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
membraneCLI tool to manage application connections, search for SEO actions, and execute requests against the Yoast SEO API. These commands are used to interact with the environment and the service provider.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the@membranehq/clipackage from the official NPM registry to provide the necessary command-line interface.\n- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes SEO configurations and metadata from external WordPress sites, which can contain untrusted content.\n - Ingestion points: Data retrieved via
get_seo_configuration,get_post_seo_configuration, and raw API responses through themembrane requestcommand.\n - Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' warnings for content fetched from the SEO plugin.\n
- Capability inventory: The agent can execute authenticated shell commands and perform network operations through the Membrane proxy.\n
- Sanitization: Absent; there is no mention of validating or escaping the SEO metadata before it is interpolated into the agent's context.
Audit Metadata