serp-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and makes requests to well-known SEO service providers including SemRush (api.semrush.com), SerpAPI (serpapi.com), and DataForSEO (api.dataforseo.com) to retrieve keyword metrics and structured SERP data.
- [COMMAND_EXECUTION]: The instructions guide the agent to use standard shell tools like curl and jq to query authorized APIs and parse JSON responses. These commands utilize variables for API keys and search terms.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and analyze the content of the top 5-10 ranking URLs from Google Search results. This external content is third-party controlled and could theoretically contain malicious instructions aimed at overriding the agent's behavior.
- Ingestion points: Untrusted web content is retrieved via the WebFetch tool during the analysis steps (Step 1, Method C and Step 3).
- Boundary markers: The skill does not provide specific delimiters or instructions to the agent to treat the fetched content as data only or to ignore embedded instructions.
- Capability inventory: The agent has access to WebSearch, WebFetch, and command-line execution (curl, jq).
- Sanitization: There are no explicit sanitization or filtering steps defined to process external website content before it is passed to the AI for analysis.
Audit Metadata