seo-onpage
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data from user-provided URLs, which establishes a surface for indirect prompt injection.\n
- Ingestion points: In the Workflow section of 'SKILL.md', the agent is instructed to fetch, render, and inspect the HTML source code of external websites.\n
- Boundary markers: The instructions do not include boundary markers or specific guidance to ignore or treat as data any potential instructions found within the HTML comments or content of the external pages.\n
- Capability inventory: The agent has the capability to write audit files to the local file system (e.g., 'seo-audit-[page-slug].md') and propose code changes, which could be exploited if malicious instructions are processed.\n
- Sanitization: There is no requirement in the skill for the agent to sanitize or validate the external content before it is processed into the audit report or proposed as a fix.
Audit Metadata