Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent SEO structured-data helper with minor usability and documentation issues but no artifact-backed malicious or high-impact behavior.
Before installing, be aware that this skill may be invoked too broadly when you say "markup" and may lead an agent to create SEO report or JSON-LD output files. Review generated schema before publishing it, especially where the guidance relies on changing Google rich-result policies.
Using the trigger term "markup" is overly broad and can cause the skill to activate in unrelated contexts such as HTML, Markdown, or general formatting tasks. Over-broad invocation increases the chance the agent applies schema-specific tooling or advice when the user did not intend it, which can lead to incorrect actions, unnecessary file generation, or confusion in multi-skill environments.
The skill advertises output files like SCHEMA-REPORT.md and generated-schema.json without warning that these files may be created or overwritten. In an agentic environment, undocumented file writes can surprise users, overwrite existing work, or place generated content in unintended locations, especially if execution is automated.
The file states at L065-L066 that Dataset is 'Not discontinued' and specifically supported for Google Dataset Search, but L216 groups Dataset with FAQPage and HowTo as no longer producing Google Search rich results. This is an active documentation-level contradiction within the skill instructions about how Dataset should be treated.
No suspicious patterns detected.
