seo-ahrefs
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@ahrefs/mcppackage (version 0.0.11), which is a remote dependency. - [COMMAND_EXECUTION]: The documentation instructs the user to run setup scripts (
extensions/ahrefs/install.shon Linux/macOS orinstall.ps1on Windows) to prepare the environment. - [DYNAMIC_EXECUTION]: The skill uses a plugin root script runner to dynamically execute
dataforseo_costs.pyfor API cost estimation logic. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data fetched from the Ahrefs API (such as anchor text, organic keywords, and content explorer results) which could contain malicious instructions.
- Ingestion points: Data retrieved from Ahrefs API endpoints and user-provided URLs.
- Boundary markers: None identified in the prompt templates.
- Capability inventory: Ability to execute local shell/PowerShell scripts and Python modules.
- Sanitization: No specific sanitization or filtering of API responses is mentioned before processing.
Audit Metadata