seo-aeo-orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The workflow identifies and executes project-specific build, test, lint, and deployment commands during Phase 2 and Phase 6.
- [DATA_EXFILTRATION]: The skill inspects environment configurations, routes, and internal content models to map the project structure in Phase 0. While intended for discovery, this involves accessing potentially sensitive configuration files.
- [INDIRECT_PROMPT_INJECTION]: The orchestrator ingests untrusted data from external websites via the
site_urlparameter and existing repository content. This content is processed by auditing and research tools, creating a risk where embedded instructions could influence the agent's code-writing or deployment actions. - Ingestion points:
site_url,existing_content(defined in SKILL.md). - Boundary markers: The workflow uses sequential gates for authorization but lacks explicit delimiters or instructions to ignore embedded prompts in external data.
- Capability inventory: File system writes (Phase 2, 5), command execution/deployment (Phase 6), and network research (Phase 4).
- Sanitization: No explicit sanitization or filtering of external content is described.
- [PERSISTENCE]: Phase 7 offers the ability to establish recurring weekly monitoring tasks, creating a mechanism for ongoing automated execution within the environment.
Audit Metadata