seo-cluster
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes internal Python scripts (
scripts/fetch_page.pyandscripts/dataforseo_costs.py) to handle web requests and validate API costs. These scripts appear to be standard utility components of the skill's infrastructure. - [EXTERNAL_DOWNLOADS]: Integrates with the DataForSEO service for SERP data and references a secondary vendor skill,
codex-blog, for content generation. These represent legitimate service integrations and vendor-owned resources relevant to the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from search engine results (titles, URLs, People Also Ask questions) to perform clustering and generate content briefs. While this presents an ingestion surface for indirect prompt injection, the skill employs validation (SSRF protection in
fetch_page.py) and analytical processing that reduces the risk of malicious payload execution.
Audit Metadata