indexnow
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bundled Node.js script (
scripts/indexnow.mjs) to automate the submission of URLs to the IndexNow API.- [EXTERNAL_DOWNLOADS]: The script performs network requests to fetch sitemap XML files from user-defined hosts and communicates with the official IndexNow API (api.indexnow.org).- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by fetching and parsing remote XML sitemaps. - Ingestion points:
urlsFromSitemapfunction inscripts/indexnow.mjsfetches data from external URLs. - Boundary markers: None used for the XML payload itself, though the script targets specific tags (
<loc>). - Capability inventory: The script performs network POST requests via
fetchand writes to local files usingfs.writeFilefor state persistence. - Sanitization: Extracted URLs are deduplicated and serialized using
JSON.stringifybefore being sent to the API or stored.
Audit Metadata