pp-dataforseo
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
dataforseo-pp-clitool using the commandnpx -y @mvanhorn/printing-press install dataforseo --cli-only. This downloads and executes code from the npm registry. - [DATA_EXFILTRATION]: The tool includes a
--deliver webhook:<url>flag that allows command output (which may contain sensitive SEO data or API results) to be POSTed to an arbitrary external URL. - [INDIRECT_PROMPT_INJECTION]: The
rank trackcommand processes external data from a user-supplied URL via the--sitemapflag. - Ingestion points: The
--sitemap <url>argument inSKILL.md(rank track recipe). - Boundary markers: None identified in the command syntax to delimit the untrusted sitemap content from the agent's instructions.
- Capability inventory: The skill uses
dataforseo-pp-cliwhich can perform network requests to DataForSEO APIs and write to a local SQLite database. - Sanitization: No explicit sanitization or validation of the sitemap content is mentioned before processing.
- [COMMAND_EXECUTION]: The skill's primary function is to execute shell commands using the
dataforseo-pp-clibinary with various arguments and flags.
Audit Metadata