technical-seo
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several local Python scripts (dfs_client.py, site_crawler.py, google_client.py, report_publish.py) to perform technical analysis and generate client deliverables. These commands are integral to the skill's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content by crawling live websites and pulling data from external APIs. This ingestion of external data constitutes a potential surface for indirect prompt injection, although it is the intended primary purpose of the SEO diagnostic tool. 1. Ingestion points: site_crawler.py (live URL fetching), dfs_client.py (DataForSEO API). 2. Boundary markers: None identified in the provided instructions. 3. Capability inventory: Subprocess execution of local scripts for crawling, API interaction, and report generation (scripts/report_publish.py). 4. Sanitization: None identified in the provided instructions.
Audit Metadata