seo-backlinks

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on executing multiple local Python scripts via subprocess calls (e.g., python scripts/moz_api.py, python scripts/verify_backlinks.py, python scripts/backlinks_auth.py). While these scripts are central to the skill's functionality, they represent a significant execution surface that requires the underlying files to be trustworthy.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external URLs, including anchor text, page content, and domain metadata from third-party sources. Maliciously crafted content on referring websites could potentially attempt to influence the agent's analysis or behavior.
  • Ingestion points: External web content crawled by scripts/verify_backlinks.py and domain metadata retrieved via scripts/commoncrawl_graph.py.
  • Boundary markers: The instructions do not explicitly define delimiters or "ignore" instructions for the data being processed from external sites.
  • Capability inventory: The skill has the capability to execute local scripts and perform network operations via provided helper tools.
  • Sanitization: No explicit sanitization or filtering of external anchor text or metadata is documented in the instruction set.
  • [EXTERNAL_DOWNLOADS]: The documentation references an installation script located at extensions/dataforseo/install.sh for a premium extension. Shell scripts used for installation are a potential vector for system-level changes and should be reviewed before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 12:50 AM