seo-content-writer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly calls the Semrush API to fetch public keyword, competitor, and top-page data (see scripts/semrush-client.ts and its use in scripts/keyword-discovery.ts and scripts/competitor-analysis.ts, plus SKILL.md's "Run Semrush keyword discovery" workflow), and that untrusted third‑party data is ingested and used to select clusters, briefs, and article actions — so external content can materially influence the agent's decisions.