seo-seranking
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill retrieves and processes external visibility data from the SE Ranking API, which introduces a surface for indirect prompt injection attacks.
- Ingestion points: API responses containing brand mentions and search engine results from various AI platforms.
- Boundary markers: The skill instructions do not specify any delimiters or safety markers to isolate retrieved data from agent instructions.
- Capability inventory: The skill environment includes execution of local shell scripts (install.sh), access to user settings files (~/.claude/settings.json), and Python script execution (dataforseo_costs.py).
- Sanitization: No data sanitization or validation logic is defined in the instructions for handling API content.- [COMMAND_EXECUTION]: The skill requires the user to execute local installation scripts (
extensions/seranking/install.shorinstall.ps1) and mentions a tracking script (scripts/dataforseo_costs.py) to manage setup and API usage logging.
Audit Metadata