r14-borghei-claude-skills-seo
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from untrusted external sources, such as website URLs and search engine results.
- Ingestion points: External website content fetched via commands like
/content-audit,/technical-seo,/page-speed-seo, and/workflows:launch-seo(SKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious content embedded in the crawled websites.
- Capability inventory: The agent is expected to perform network requests to external domains and write analysis reports to the local filesystem (
./reports/,daily-technical.json). - Sanitization: There is no mention of sanitizing or filtering the content retrieved from external websites before processing it.
- [DATA_EXPOSURE]: The skill documentation references the use of sensitive API keys for SEO tools (SEMRUSH, AHREFS, Google Search Console) but follows best practices by instructing the user to store them in environment variables rather than hardcoding them.
Audit Metadata