noindex-in-sitemap
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill instructions require the agent to fetch and process content from external URLs listed in a sitemap. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the target website's metadata or headers.
- Ingestion points: XML sitemaps and the HTML/headers of URLs discovered within those sitemaps (referenced in SKILL.md and references/rule.md).
- Boundary markers: None specified; the agent is not instructed to use specific delimiters or to disregard instructions found within the audited content.
- Capability inventory: The skill utilizes network fetching and page parsing to inspect
robotsmeta tags andX-Robots-Tagheaders. - Sanitization: No sanitization or filtering of external content is defined.
- [EXTERNAL_DOWNLOADS]: The skill fetches configuration and documentation from the author's project domain (frontendchecklist.io) and official Google documentation. It also fetches data from sitemaps and website pages to perform its audit, which is intrinsic to the skill's primary purpose.
Audit Metadata