seo-backlinks
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple local Python and shell scripts for its core operations, including
backlinks_auth.pyfor source detection,moz_api.pyandbing_webmaster.pyfor API interaction, andinstall.shfor setting up extensions. These scripts are invoked through a CLI interface to perform automated analysis tasks. - [INDIRECT_PROMPT_INJECTION]: The skill features a "Verification Crawler" (
verify_backlinks.py) that processes content from external URLs to verify link status. This creates an ingestion surface for potentially malicious instructions hidden in target websites. - Ingestion points: Target URLs and link data files processed by the
verify_backlinks.pycrawler (specified inSKILL.md). - Boundary markers: The skill instructions do not explicitly define delimiters to isolate external content from the agent's internal reasoning.
- Capability inventory: The skill possesses the ability to execute various internal scripts and perform network operations via external APIs.
- Sanitization: While the skill includes a "Pre-Delivery Review" to verify data accuracy and platform signals, it lacks explicit sanitization or filtering logic designed to mitigate prompt injection from crawled content.
- [EXTERNAL_DOWNLOADS]: The skill retrieves SEO data from well-known services and repositories, including Moz API, Bing Webmaster, DataForSEO, and Common Crawl. It also references an installation script for managing the DataForSEO extension within its local environment.
Audit Metadata