seo-backlinks
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing multiple local Python scripts via subprocess calls (e.g.,
python scripts/moz_api.py,python scripts/verify_backlinks.py,python scripts/backlinks_auth.py). While these scripts are central to the skill's functionality, they represent a significant execution surface that requires the underlying files to be trustworthy. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external URLs, including anchor text, page content, and domain metadata from third-party sources. Maliciously crafted content on referring websites could potentially attempt to influence the agent's analysis or behavior.
- Ingestion points: External web content crawled by
scripts/verify_backlinks.pyand domain metadata retrieved viascripts/commoncrawl_graph.py. - Boundary markers: The instructions do not explicitly define delimiters or "ignore" instructions for the data being processed from external sites.
- Capability inventory: The skill has the capability to execute local scripts and perform network operations via provided helper tools.
- Sanitization: No explicit sanitization or filtering of external anchor text or metadata is documented in the instruction set.
- [EXTERNAL_DOWNLOADS]: The documentation references an installation script located at
extensions/dataforseo/install.shfor a premium extension. Shell scripts used for installation are a potential vector for system-level changes and should be reviewed before execution.
Audit Metadata