The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script, scripts/backlinks-audit.py, which is designed to be executed by the agent to automate the auditing of backlink profiles.
[EXTERNAL_DOWNLOADS]: The backlinks-audit.py script performs outbound network requests to index.commoncrawl.org, api.dataforseo.com, and arbitrary third-party URLs provided in a local input file to verify the existence of backlinks.
[EXTERNAL_DOWNLOADS]: Automated security scanners flagged affine.pro and its subpages as malicious/blacklisted. This domain is used throughout the skill's documentation and templates as a primary example for backlink building activities.
[INDIRECT_PROMPT_INJECTION]: The audit script ingests up to 500KB of content from external websites to verify link presence. This creates a vulnerability where an agent processing the script's output could be influenced by malicious instructions or data hidden on those remote pages.
Ingestion points: verify_known_link function in scripts/backlinks-audit.py reads content from user-supplied URLs.
Boundary markers: None identified in the script's output to the agent.
Capability inventory: The script can perform network requests and read local files; if the agent follows instructions from crawled content, it could escalate these capabilities.
Sanitization: No sanitization is performed on the ingested content beyond basic UTF-8 decoding.
[DYNAMIC_EXECUTION]: The backlinks-audit.py script utilizes the __import__ function to dynamically load the datetime module. While used for a standard library here, dynamic loading can be an indicator of more complex obfuscation or a vector for executing unexpected code if module names were externally controlled.
[SAFE]: The skill correctly instructs the user to manage sensitive API credentials (such as the DataForSEO key) using environment variables (DATAFORSEO_B64) rather than hardcoding them.

gr-backlinks