seo-program-planner
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides an installation command utilizing
npxto fetch resources from the author's verified GitHub repository (github.com/peter-tu-zynkr/zynkr-skill-builder). As the repository is owned by the skill's author, this represents legitimate vendor resource acquisition. - [COMMAND_EXECUTION]: The orchestrator utilizes the Skill tool to programmatically dispatch and collect data from multiple sub-skills (e.g.,
seo-persona-builder,seo-question-miner,seo-keyword-mapper). This execution is contained within the platform's standard agent capabilities and follows the intended workflow of a multi-stage planner. - [DATA_EXPOSURE_AND_EXFILTRATION]: The configuration file (
seo-program-config.md) includes hardcoded Google Drive folder IDs and a business email address (peter_tu@zynkr.ai). These identifiers are used solely as deployment targets for generated SEO plans and keyword sheets, serving as standard project configuration rather than sensitive credential exposure. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content from Google Drive documents and user-provided URLs. While this creates a surface for potential indirect instructions, the skill mitigates risk by implementing mandatory 'Human-In-The-Loop' (HITL) gates at every stage, requiring explicit user confirmation before advancing or generating deliverables.
- Ingestion points: Product intake URLs, Google Drive master rubrics, and user-provided website data.
- Boundary markers: The skill defines clear operational boundaries between itself and downstream article pipelines.
- Capability inventory: Document generation via
import_to_google_doc, spreadsheet assembly viaimport_to_google_sheets, and cross-skill orchestration. - Sanitization: The instructions focus on house-style compliance and signal-based validation to ensure data integrity.
Audit Metadata