seo-aeo-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from search results, web pages, repository files, and API fields, which can contain malicious instructions intended to hijack the agent's behavior.
- Ingestion points: Search results, live website URLs, repository files, API fields, and user messages (SKILL.md, Phase 0, Phase 4).
- Boundary markers: The skill contains an 'Untrusted evidence boundary' section that explicitly instructs the agent to treat all external inputs as untrusted and to ignore embedded instructions or commands.
- Capability inventory: The skill allows the agent to write files, modify codebase, execute build/test commands, access Search Console/Bing APIs, and perform deployments.
- Sanitization: The instructions require the agent to 'Quote bounded facts' and perform 'Static inspection' of commands before execution.
- [COMMAND_EXECUTION]: The workflow requires executing project-specific commands for building, testing, linting, and deployment (Phase 2 and Phase 6). These commands are derived from the repository itself, which could be exploited if an attacker has modified the project's configuration (e.g., package.json scripts). The skill includes a mitigation requiring user approval and static inspection before execution.
Audit Metadata