seo
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It ingests untrusted data from project files (such as metadata, content, and llms.txt) and possesses high-privilege capabilities to modify code and execute build/test commands, which could be exploited by malicious content within the audited files.
- Ingestion points: Phase 1 through 4 involve reading all project files, including HTML, robots.txt, sitemaps, and structured data.
- Boundary markers: The skill does not use specific delimiters or instructions to distinguish between its own logic and the untrusted content it audits.
- Capability inventory: The skill is instructed to "Fix the code directly", "Verify the fix compiles (build)", "Run tests", and "Commit fixes".
- Sanitization: There is no evidence of sanitization or safety checks performed on the ingested data before it influences the agent's code-writing actions.
- [COMMAND_EXECUTION]: The skill performs persistent file system operations outside the target project by writing to
~/.claude/projects/skill-telemetry.md. This behavior is used for self-evolution telemetry and involves accessing the user's home directory to store execution outcomes.
Audit Metadata