seo-technical
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx lighthouse@latestto execute performance and SEO audits. This involves downloading and running code from the official NPM registry, which is a standard method for this well-known tool from Google. - [COMMAND_EXECUTION]: The skill executes local Python scripts, such as
sitemap_discovery.pyandagent_ux_check.py, using a project-specific CLIclaude-seo run. These scripts perform the specialized analysis required for technical SEO audits and are consistent with the skill's stated functionality. - [PROMPT_INJECTION]: The skill processes data from external websites, creating a surface for indirect prompt injection. 1. Ingestion points: website HTML, robots.txt, and accessibility trees fetched via
render_page.pyandagent_ux_check.py. 2. Boundary markers: No explicit delimiters or 'ignore' instructions are defined for the ingested content. 3. Capability inventory: Includes command execution via theclaude-seowrapper and file access for audit analysis. 4. Sanitization: No specific escaping or filtering of external content is described in the provided instructions. These risks are inherent to web analysis tasks and are typically mitigated by platform-level guardrails.
Audit Metadata