indexability
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to parse HTML content and HTTP headers from external websites to audit SEO directives like 'noindex' tags and 'X-Robots-Tag' headers. This creates an attack surface where a malicious website could embed prompt injection instructions within HTML comments or meta tags to manipulate the agent's behavior during the audit process.
- Ingestion points: External website HTML bodies and HTTP response headers (referenced in
SKILL.mdunder 'Code Review' andreferences/rule.mdunder 'Testing indexability'). - Boundary markers: No explicit delimiters or boundary markers are defined to help the agent distinguish between the website's data and the skill's instructions.
- Capability inventory: The skill utilizes network fetching capabilities (demonstrated by
curlusage inreferences/rule.md) and HTML parsing logic. - Sanitization: There are no instructions for sanitizing or filtering the fetched content before it is processed by the agent's logic.
Audit Metadata