seo-aeo-schema-generator
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external page data (such as FAQ answers and product details) and map them into JSON-LD templates. This creates a potential vector for indirect prompt injection if the processed content contains malicious instructions or code.
- Ingestion points: External page data and content provided by the user or retrieved from a URL (referenced in
SKILL.mdunder 'Step 3: Populate Fields'). - Boundary markers: None. The instructions do not define delimiters or markers to isolate ingested content from the agent's logic, increasing the risk that the agent might follow instructions embedded in the data.
- Capability inventory: The skill generates
<script type="application/ld+json">blocks. If an attacker can inject content that breaks out of the JSON string (e.g., using</script><script>), it could lead to cross-site scripting (XSS) on the site where the schema is implemented. - Sanitization: The skill provides a natural language constraint in the 'Best Practices' section ("Don't: Use HTML tags inside JSON-LD string values"). While this demonstrates awareness of the risk, it relies purely on model compliance rather than technical sanitization or validation.
Audit Metadata