backlink-audit

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute curl commands for querying SemRush and Ahrefs API endpoints. This is the intended primary purpose of the skill, allowing it to retrieve external SEO data.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external APIs that includes untrusted content from the web, such as anchor text and page titles. This content is then interpolated into reports and disavow files.
  • Ingestion points: API responses from api.semrush.com and api.ahrefs.com containing third-party web data (source URLs, anchor text).
  • Boundary markers: Absent. External data is directly inserted into markdown tables and text blocks.
  • Capability inventory: The skill can execute shell commands via curl and write files (reports and .txt disavow files) to the local filesystem.
  • Sanitization: No specific sanitization or filtering logic is defined for the incoming API data before it is presented in the final report.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 12:47 PM