The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on shell command execution via npx @useclawlink/cli for all operations. It interpolates user-provided descriptions and JSON payloads directly into command arguments, which requires the executing agent to ensure proper shell escaping to prevent command injection.
[EXTERNAL_DOWNLOADS]: Fetches and runs the @useclawlink/cli package from the NPM registry using npx. This package is the official tool provided by the skill's author to facilitate the integration.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data retrieved from Semrush, such as search results, keyword data, and domain profiles, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: External data enters the context through actions like semrush_organic_results, semrush_keyword_overview_one_database, and semrush_backlinks.
Boundary markers: The instructions do not include specific delimiters or 'ignore' directives to isolate the retrieved data from the agent's core instructions.
Capability inventory: The agent has the ability to execute shell commands and modify local files (e.g., credentials) using the ClawLink CLI.
Sanitization: There is no mention of sanitization or validation logic applied to the data fetched from the Semrush API.

semrush