seo-backlinks

Pass

Audited by Gen Agent Trust Hub on Aug 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple local Python and shell scripts for its core operations, including backlinks_auth.py for source detection, moz_api.py and bing_webmaster.py for API interaction, and install.sh for setting up extensions. These scripts are invoked through a CLI interface to perform automated analysis tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill features a "Verification Crawler" (verify_backlinks.py) that processes content from external URLs to verify link status. This creates an ingestion surface for potentially malicious instructions hidden in target websites.
  • Ingestion points: Target URLs and link data files processed by the verify_backlinks.py crawler (specified in SKILL.md).
  • Boundary markers: The skill instructions do not explicitly define delimiters to isolate external content from the agent's internal reasoning.
  • Capability inventory: The skill possesses the ability to execute various internal scripts and perform network operations via external APIs.
  • Sanitization: While the skill includes a "Pre-Delivery Review" to verify data accuracy and platform signals, it lacks explicit sanitization or filtering logic designed to mitigate prompt injection from crawled content.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves SEO data from well-known services and repositories, including Moz API, Bing Webmaster, DataForSEO, and Common Crawl. It also references an installation script for managing the DataForSEO extension within its local environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 29, 2026, 01:16 PM