geo-site-diagnose
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to crawl and ingest content from external, user-supplied URLs for diagnostic analysis. This untrusted content is introduced into the agent's context, which could lead to indirect prompt injection if a website contains malicious instructions intended to subvert the agent's scoring or advice.\n
- Ingestion points: The
scripts/run_site_diagnose.pyscript fetches data from the supplied public website URL.\n - Capability inventory: The skill has network GET access, file-writing capabilities (creating reports and artifacts), and subprocess execution permissions.\n
- Sanitization: The skill's documentation mentions escaping content for the HTML report, but the agent's interpretation of the content during the analysis phase remains a vulnerability surface.\n
- Boundary markers: The instructions lack specific delimiters or boundary warnings to isolate external data from the agent's operational logic.\n- [COMMAND_EXECUTION]: The script
scripts/run_site_diagnose.pyexecutes an external Python module usingsubprocess.runto perform the site analysis.\n - Evidence: The diagnostic workflow involves constructing a command list and invoking the
geo_seo_hubmodule with user-supplied parameters.\n - Mitigation: The implementation uses a list-based argument structure instead of a shell string, and the URL is validated for proper syntax and host constraints prior to execution to prevent command injection.
Audit Metadata