seo-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from website audits and interpolates it into a generated HTML report.
- Ingestion points: Website audit data (titles and descriptions) is fetched from the Google PageSpeed Insights API in
analyze.ts. - Boundary markers: No delimiters or warnings are used to separate the data from the HTML structure.
- Capability inventory: The skill utilizes
fs.writeFileSyncto save the generated HTML report to the local filesystem. - Sanitization: Audit content is inserted directly into the report's HTML via string interpolation without escaping, which could theoretically allow for code injection if the source data were malicious.
- [EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to fetch data from well-known and trusted sources.
- Fetches performance metrics from Google's official PageSpeed Insights API.
- The generated HTML report references the Chart.js library from the jsDelivr CDN.
- [COMMAND_EXECUTION]: The skill instructions and documentation advise running the analysis script using
npx ts-node, which executes the TypeScript code in a Node.js environment.
Audit Metadata