The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/pagespeed.sh uses a Python heredoc to perform URL encoding at runtime. This involves dynamic generation and execution of a script for a specific utility task.
[INDIRECT_PROMPT_INJECTION]: The skill audits external websites and processes reports generated by third-party tools. This creates an attack surface where malicious content on an audited site could influence the agent's analysis or subsequent actions.
Ingestion points: scripts/lighthouse.sh, scripts/pagespeed.sh, and scripts/search-console-export.mjs generate JSON reports in the reports/ directory which are intended to be read and analyzed by the agent.
Boundary markers: The skill instructions do not specify delimiters or explicit "ignore embedded instructions" warnings for the content of these reports when the agent processes them.
Capability inventory: The skill utilizes tools for shell command execution (lighthouse, curl, node), file system writes, and network access.
Sanitization: No explicit sanitization, validation, or filtering is applied to the data retrieved from external URLs or APIs before it is stored or presented to the agent.
[COMMAND_EXECUTION]: The skill utilizes shell and Node.js scripts to execute various command-line tools such as lighthouse, curl, and mkdir to perform its auditing functions. These are standard operations for a development and auditing tool.
[EXTERNAL_DOWNLOADS]: The scripts interact with official Google APIs (googleapis.com) to retrieve performance and search analytics data. These references target well-known and trusted technology services for their intended purpose.

seo-aeo-audit