keywords

Pass

Audited by Gen Agent Trust Hub on Jul 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a bash script (hooks/pre-tool.sh) used as a pre-tool hook to provide instructions to the agent when specific tools like WebSearch or Bash are invoked. It also contains Python scripts (autocomplete_ideas.py, keyword_research.py, related_keywords.py) for processing keyword data.
  • [EXTERNAL_DOWNLOADS]: The Python scripts are configured to communicate with the DataForSEO API, a well-known service for SEO data, to retrieve search engine suggestions and keyword metrics. These interactions are consistent with the skill's primary purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external data from an API without explicit sanitization or boundary markers.
  • Ingestion points: API response processing in scripts/autocomplete_ideas.py, scripts/keyword_research.py, and scripts/related_keywords.py.
  • Boundary markers: Absent.
  • Capability inventory: The agent is instructed to use WebFetch, WebSearch, and Bash tools in the context of this skill.
  • Sanitization: Not present; the scripts print external API results directly to stdout for agent consumption.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 5, 2026, 04:24 PM
Security Audit — agent-trust-hub — keywords