The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted external data from remote websites.
Ingestion points: The agent is instructed to read content from robots.txt and XML sitemap files fetched from URLs provided by the user in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from obeying malicious instructions that might be embedded within the processed XML tags or text comments.
Capability inventory: The skill has the ability to execute the claude-seo command and write multiple files to the local system (VALIDATION-REPORT.md, sitemap.xml, STRUCTURE.md).
Sanitization: The skill description mentions a "shared SSRF-safe fetch layer" and performs XML format validation, which mitigates some technical exploitation risks but not semantic prompt injection.
[COMMAND_EXECUTION]: The skill relies on an external CLI tool and Python script (claude-seo run sitemap_discovery.py) to perform its primary analysis functions. While the tool is associated with the project's documentation, the execution of external scripts on the host system represents an unverified dependency risk.
[COMMAND_EXECUTION]: The skill instructions specify accessing resources in a sibling directory (../seo-plan/assets/). This cross-directory file access could be a concern in restricted environments if the agent has permissions to read sensitive files outside of the skill's intended scope.

seo-sitemap