The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits third-party websites and extracts content such as titles, meta tags, and headings. This content is presented to the AI agent, creating an indirect prompt injection surface if a website contains malicious instructions.
Ingestion points: HTML content is fetched from arbitrary URLs via the Auditor and Crawler classes and formatted for the LLM.
Boundary markers: The skill implements a sophisticated defense-in-depth model. The LLM reporter (--format llm) uses per-report 128-bit hex nonces and nonce-stamped delimiters (<untrusted-{nonce}>...<untrusted-{nonce}>) to wrap all site-derived text. This prevents an attacker from forging a closing tag.
Sanitization: The tool automatically strips zero-width characters (U+200B–U+200D, U+2060, U+FEFF) and Unicode tag block characters (U+E0000–U+E007F) commonly used for steganographic injection. It also applies XML escaping to all quoted content.
Capability inventory: The skill is allowed to execute the seomator binary via the Bash tool, which primarily performs network requests and local database operations.
[DATA_EXFILTRATION]: Potential Server-Side Request Forgery (SSRF). The tool follows redirects and performs link checks on user-supplied URLs, which could be leveraged to probe internal network services or cloud metadata endpoints.
Evidence: The TODOS.md file explicitly identifies 'Engine SSRF hardening' as a deferred security task. It notes that a malicious audited page can point the redirect following and link checking logic at internal services (loopback, RFC1918, link-local).

seo-audit