seo-domain-analyzer
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFEPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface (Category 8) because it processes untrusted data from scraped web content.
- Ingestion points: Data retrieved from external domains via Semrush, Ahrefs, and Google Search scrapers in
scripts/analyze_domain.py. - Boundary markers: No delimiters are used to separate scraped content from agent instructions.
- Capability inventory: The skill has network access (via the
requestslibrary) and the ability to write files to disk. - Sanitization: Scraped data is incorporated into the analysis without filtering or escaping.
- [CREDENTIALS_UNSAFE]: The script
scripts/analyze_domain.pytransmits theAPIFY_API_TOKENas a query parameter in URLs. This is a security weakness as it increases the risk of the token being logged or exposed in transit, compared to using authorization headers.
Audit Metadata