seo-technical

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub URL points to a personal/unknown repository that contains runnable CLI scripts the skill instructs users to execute (potentially delivering code outside official package managers), while the other URLs are official/documentation sites and are not suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow is an on-demand crawl/render of a user-supplied URL (Playwright snapshot / accessibility tree), so the LLM context can include outsider-authored free text extracted from that public page/DOM at runtime (e.g., SKILL.md’s “claude-seo run agent_ux_check.py … https://example.com --json”).