seo-audit-report
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform standard development tasks such as project initialization (npm create vite), package installation (npm install), and starting a development server (npm run dev). These actions are required for the skill's primary function of scaffolding a web application.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting external SEO data from CSV and JSON files, which represents an indirect injection surface. Ingestion points: Data is imported from live Google Search Console (GSC) connections or local JSON/CSV exports (SKILL.md). Boundary markers: The instructions do not specify explicit prompt boundaries or delimiters for the imported data. Capability inventory: The skill utilizes shell command execution for environment setup and application runtime (SKILL.md). Sanitization: The skill implements data validation and type coercion using the zod library to sanitize inputs before storage in the local database (SKILL.md).
- [DYNAMIC_EXECUTION]: The skill uses sql.js, which is a WebAssembly-based SQLite engine, to execute database queries within the browser environment. It also involves the generation of a Vite project scaffold and React components during the setup phase.
Audit Metadata