seo-health
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts 'health-crawl.sh', 'health-images.sh', and 'health-speed.sh' utilize standard command-line tools such as 'curl' and 'jq' to perform their auditing tasks. This behavior is consistent with the skill's stated purpose of monitoring technical SEO health.
- [EXTERNAL_DOWNLOADS]: The skill fetches data from Google's official PageSpeed Insights API, a well-known technology service. It also performs web requests to crawl and analyze domains specified by the user during the audit process.
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection. It extracts content from HTML elements such as title tags, meta descriptions, and image alt text from external websites. If an audited site contains malicious instructions in its metadata, the agent reviewing the results could be influenced.
- Ingestion points: External HTML bodies are retrieved and parsed for metadata in 'scripts/health-crawl.sh' and 'scripts/health-images.sh'.
- Boundary markers: None identified; extracted content is written directly into JSON report files without delimiters or warnings.
- Capability inventory: The skill has the capability to make network requests via 'curl' and write files to the local workspace.
- Sanitization: No sanitization or filtering is performed on the text strings extracted from external web pages before they are recorded in snapshots.
Audit Metadata