seo-backlinks
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several local Python scripts, such as
moz_api.py,bing_webmaster.py, andverify_backlinks.py, located within the${CLAUDE_PLUGIN_ROOT}/scripts/claude-seodirectory. These commands are used to process and analyze SEO data and are appropriate for the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The skill interfaces with well-known external services and APIs, including Moz, Bing Webmaster Tools, DataForSEO, and Common Crawl, to retrieve link profiles and domain metrics. These references target established technology services and are documented for transparency.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted external data (backlink anchor text and domain information) which could potentially be used for indirect prompt injection. This risk is addressed through a structured evidence chain:
- Ingestion points: External link and domain data are ingested via
moz_api.py,bing_webmaster.py,dataforseo_backlinks_anchors, and the verification crawler mentioned inSKILL.md. - Boundary markers: The skill requires source-labeling for every metric (e.g., "Moz (0.85)") and enforces data sufficiency gates to prevent misleading reports.
- Capability inventory: The skill uses subprocess calls to local scripts to perform analysis and validation.
- Sanitization: All generated reports must pass a validation script (
validate_backlink_report.py) and a mandatory "Pre-Delivery Review" checklist that includes fact-checking and source verification.
Audit Metadata