The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute multiple Python scripts, including validate_platform_controls.py, validate_seo_findings.py, manage_markdown_site.py, and manage_markdown_work.py, to perform its core functions.
[DYNAMIC_EXECUTION]: The execution paths for these scripts are determined dynamically at runtime. The <suite-root> path is resolved by reading a local configuration file (.seo-suite-runtime.json) present in the repository or by using an environment variable (${CLAUDE_PLUGIN_ROOT}). If an attacker provides a malicious repository containing a crafted .seo-suite-runtime.json file, they could redirect the agent to execute malicious scripts from an arbitrary directory.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing untrusted external data, such as rendered web page sources and factual content from URLs. This creates a vulnerability where malicious instructions embedded in HTML comments or page text could attempt to override the agent's behavior.
Ingestion points: Rendered page source and factual content referenced in SKILL.md.
Boundary markers: None explicitly specified for the ingestion of external web content.
Capability inventory: The skill possesses the ability to execute local Python scripts and write files to the local file system.
Sanitization: No specific sanitization or escaping of external content is mentioned before processing.
[DATA_EXFILTRATION]: The skill includes a process for exporting private Markdown notes to public sites. While it contains a specific guardrail in references/markdown-delivery-contract.md to prevent the inclusion of credentials, admin URLs, and personalized content, the presence of a pipeline that moves data from private to public spheres remains a risk factor.

seo-schema