backlink-audit
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute
curlcommands for querying SemRush and Ahrefs API endpoints. This is the intended primary purpose of the skill, allowing it to retrieve external SEO data. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external APIs that includes untrusted content from the web, such as anchor text and page titles. This content is then interpolated into reports and disavow files.
- Ingestion points: API responses from
api.semrush.comandapi.ahrefs.comcontaining third-party web data (source URLs, anchor text). - Boundary markers: Absent. External data is directly inserted into markdown tables and text blocks.
- Capability inventory: The skill can execute shell commands via
curland write files (reports and.txtdisavow files) to the local filesystem. - Sanitization: No specific sanitization or filtering logic is defined for the incoming API data before it is presented in the final report.
Audit Metadata