seo-geo-skill-finder
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is designed to fetch a structured JSON catalog (
catalog.json) from the author's public repository on GitHub. This is a legitimate use of a well-known service to provide dynamic updates to the recommendation list. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote source that includes metadata and installation commands for other skills. This creates an attack surface for indirect prompt injection if the remote data were to contain malicious instructions. However, the skill provides specific guardrail instructions for the agent to include safety warnings about reviewing third-party scripts and explicitly prohibits the execution of installation commands without user approval.
Audit Metadata