keywords
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash script (
hooks/pre-tool.sh) used as a pre-tool hook to provide instructions to the agent when specific tools like WebSearch or Bash are invoked. It also contains Python scripts (autocomplete_ideas.py,keyword_research.py,related_keywords.py) for processing keyword data. - [EXTERNAL_DOWNLOADS]: The Python scripts are configured to communicate with the DataForSEO API, a well-known service for SEO data, to retrieve search engine suggestions and keyword metrics. These interactions are consistent with the skill's primary purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external data from an API without explicit sanitization or boundary markers.
- Ingestion points: API response processing in
scripts/autocomplete_ideas.py,scripts/keyword_research.py, andscripts/related_keywords.py. - Boundary markers: Absent.
- Capability inventory: The agent is instructed to use
WebFetch,WebSearch, andBashtools in the context of this skill. - Sanitization: Not present; the scripts print external API results directly to stdout for agent consumption.
Audit Metadata