geo-site-diagnose

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to crawl and ingest content from external, user-supplied URLs for diagnostic analysis. This untrusted content is introduced into the agent's context, which could lead to indirect prompt injection if a website contains malicious instructions intended to subvert the agent's scoring or advice.\n
  • Ingestion points: The scripts/run_site_diagnose.py script fetches data from the supplied public website URL.\n
  • Capability inventory: The skill has network GET access, file-writing capabilities (creating reports and artifacts), and subprocess execution permissions.\n
  • Sanitization: The skill's documentation mentions escaping content for the HTML report, but the agent's interpretation of the content during the analysis phase remains a vulnerability surface.\n
  • Boundary markers: The instructions lack specific delimiters or boundary warnings to isolate external data from the agent's operational logic.\n- [COMMAND_EXECUTION]: The script scripts/run_site_diagnose.py executes an external Python module using subprocess.run to perform the site analysis.\n
  • Evidence: The diagnostic workflow involves constructing a command list and invoking the geo_seo_hub module with user-supplied parameters.\n
  • Mitigation: The implementation uses a list-based argument structure instead of a shell string, and the URL is validated for proper syntax and host constraints prior to execution to prevent command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 02:50 PM
Security Audit — agent-trust-hub — geo-site-diagnose