topical-coverage-comparison
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts to perform its primary functions:
scripts/project_memory.pyfor context retrieval,scripts/dfs_client.pyfor fetching ranking data from external SEO providers, andscripts/report_publish.pyfor generating branded HTML/PDF reports. These calls are restricted to the skill's own script directory. - [INDIRECT_PROMPT_INJECTION]: The skill has a potential surface for indirect prompt injection as it processes untrusted data.
- Ingestion points: External data is ingested via
webfetchof competitor web pages (Step 5) and through keyword lists retrieved from third-party SEO APIs. - Boundary markers: The instructions do not specify explicit delimiters or warnings to ignore instructions embedded in the fetched competitor content.
- Capability inventory: The skill writes analysis results to the file system (e.g.,
TOPICAL-COVERAGE-*.md) and executes scripts to publish reports. - Sanitization: No specific sanitization or filtering of the external web content is mentioned, though the data is primarily used for clustering and visibility scoring.
Audit Metadata