indexnow-instant-indexing-audit
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlcommands to perform HTTP inspections of the target website's IndexNow implementation. These are standard, read-only diagnostic checks (e.g.,curl -s -i "https://example.com/${KEY}.txt"). - [REMOTE_CODE_EXECUTION]: The skill uses a small Python snippet via a heredoc in
references/checks.mdto perform static validation of JSON payloads. This execution is local, uses standard libraries (json,urllib.parse), and processes static configuration rather than remote input. - [DATA_EXFILTRATION]: There is no evidence of data exfiltration. The skill includes a 'Live Submission Test' that sends data to
api.indexnow.org, which is the official endpoint for the IndexNow protocol. The skill includes explicit guardrails requiring user authorization before performing this state-changing action. - [PROMPT_INJECTION]: The skill instructions are focused on protocol auditing and do not contain patterns designed to bypass safety filters or override system instructions.
- [DYNAMIC_EXECUTION]: The Python script used for path scoping is a static template for data processing and does not incorporate untrusted remote code or unsafe deserialization.
Audit Metadata