The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses natural instructional language to define its role as an SEO desk. No attempts to override safety filters or extract system prompts were detected. Instructions to favor the UI over chat are operational and within scope.
[DATA_EXPOSURE]: Secret management is handled safely. The skill uses environment variables for Google service account keys and OAuth tokens (KELLY_SEO_GSC_SERVICE_ACCOUNT_FILE, KELLY_SEO_GSC_ACCESS_TOKEN). Documentation explicitly warns against committing keys or configuration files. Data storage in Busabase is structured and scoped to SEO analytics.
[REMOTE_CODE_EXECUTION]: Dependencies are pinned to specific versions (e.g., busabase-sdk@0.11.0). External requests are limited to official Google APIs (googleapis.com) for Search Console data and the vendor's platform (busabase.com). There are no patterns of piping remote scripts to a shell.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Search Console. It implements an evidence chain via a mandatory geo-qa quality gate (evaluateGeoGate in app/app/js/seo-model.js) which re-evaluates proposed changes for factual grounding and structural citations before they can be approved. Site edits are executed by the agent in a separate repo/CMS outside the app's direct control, maintaining a clear security boundary.
[COMMAND_EXECUTION]: The execute_decisions.mjs script operates on a dry-run basis by default. It plans operations like rewrite_title or add_internal_links but does not perform direct shell execution against the host system to modify live site content. Actual implementation is deferred to the agent following user approval.
[OBFUSCATION]: The code uses standard cryptographic and encoding utilities for OAuth 2.0 PKCE and JWT signing (e.g., randomBase64Url). These are legitimate functional requirements for GSC authentication and do not hide malicious intent or URLs.

kelly-seo