seo-ahrefs
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent/user to execute local shell and PowerShell scripts (
extensions/ahrefs/install.shandinstall.ps1) for installation. It also references a cost-tracking Python script (dataforseo_costs.py) that is executed via a CLI tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web via the Ahrefs Content Explorer and backlink analysis tools. This content could theoretically contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Data returned from Ahrefs API tools defined in the routing table (e.g., Content Explorer results).
- Boundary markers: None identified in the skill instructions to delimit external content or warn the agent about embedded instructions.
- Capability inventory: The skill primarily performs data retrieval and analysis, with cost-logging capabilities mentioned.
- Sanitization: There are no explicit instructions for sanitizing or filtering the API responses before they are processed by the agent.
Audit Metadata