Security audit
Security checks for vulnerabilities and agentic risk
This schema generator is mostly coherent, but it needs review because it fetches arbitrary URLs and can produce unsafe HTML for websites.
Install only if you are comfortable reviewing URL inputs and generated HTML before use. Avoid running the URL or sitemap features on untrusted links, and do not paste HTML output into a live site unless script-tag breakout characters are escaped or the JSON-LD is otherwise sanitized.
scripts/generate_schema.py:284Unrestricted URL Fetching Enables Server-Side Request Forgery
scripts/generate_schema.py:329Unescaped JSON-LD HTML Output Enables Script-Tag Breakout and Cross-Site Scripting
If the implementation is actually validator-only or otherwise substantially narrower than the stated generation behavior, the skill can mislead users and upstream agents into invoking the wrong workflow. While this is more of an integrity and trust issue than a direct exploit primitive, it can still cause unsafe reliance on nonexistent functionality and accidental mishandling of user content.
If the implementation is actually validator-only or otherwise substantially narrower than the stated generation behavior, the skill can mislead users and upstream agents into invoking the wrong workflow. While this is more of an integrity and trust issue than a direct exploit primitive, it can still cause unsafe reliance on nonexistent functionality and accidental mishandling of user content.
If the implementation is actually validator-only or otherwise substantially narrower than the stated generation behavior, the skill can mislead users and upstream agents into invoking the wrong workflow. While this is more of an integrity and trust issue than a direct exploit primitive, it can still cause unsafe reliance on nonexistent functionality and accidental mishandling of user content.
The manifest promises 'complete, validated Schema.org JSON-LD markup for any content type,' but the code supports only a fixed list of schema types and mostly fills templates from user input without validating required fields, URL structure, or Schema.org conformance. Returning unknown input types as-is from generate_from_file further shows the tool does not ensure completeness or validation.
The skill advertises and documents operations that imply reading local files, writing output, and fetching remote URLs, but it declares no explicit tool scope or permission boundaries. This is dangerous because an agent may invoke broader file or network capabilities than users expect, increasing the chance of unintended data exposure, uncontrolled outbound requests, or writing artifacts to sensitive locations.
The activation text uses very broad trigger phrases such as any request about schema, structured data, rich snippets, or AI understanding, which can cause the skill to be selected in contexts beyond its actual competence or safety envelope. In an agent system, over-broad routing increases the likelihood of unintended execution, unnecessary file/network operations, and user confusion about what the skill will do.
The manifest describes support for Organization, FAQPage, Article, BlogPosting, Product, HowTo, BreadcrumbList, WebSite, VideoObject, and ImageObject. However, the code detects and emits "LocalBusiness" and defaults to "WebPage", which are outside the stated set of supported outputs. This means the implemented behavior exceeds and diverges from the manifest's declared schema coverage.
The manifest description says the skill creates Schema.org markup for ImageObject, but neither SCHEMA_TEMPLATES nor the CLI choices include ImageObject as a top-level schema type. The implementation only embeds ImageObject as a nested publisher logo object, so the advertised capability is not actually provided.
The script takes a user-supplied URL and fetches it directly with requests.get() without any allowlisting, scheme restriction, or private-address filtering. In an agent/automation context, this creates a server-side request forgery surface that can be abused to access internal services, cloud metadata endpoints, or other network resources reachable from the runtime environment.
import requests
from bs4 import BeautifulSoup
resp = requests.get(url, timeout=10)
soup = BeautifulSoup(resp.text, 'html.parser')
template = SCHEMA_TEMPLATES.get(schema_type, {}).copy()
The example availableLanguage value explicitly limits support to English and Spanish, which can be read as prescribing a fixed language set. In a reference document, this is not framed as an optional example or justified as region-specific, so it may conflict with language/locale choice expectations.
The manifest frames the skill as generating validated Schema.org JSON-LD for content, but this script performs sitemap fetching, multi-page crawling, page-type inference, and bulk file generation across many URLs. While related, this is a broader operational capability than the manifest describes, especially as it introduces autonomous site traversal from a sitemap rather than generating markup for provided content.
The implementation includes a full LocalBusiness template and interactive generation flow, but the manifest's enumerated supported types does not mention LocalBusiness. This creates a mismatch between documented capabilities and actual behavior.
No suspicious patterns detected.