keyword-research

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the bash tool to execute curl and jq commands for API communication and data processing.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with well-known SEO and search data services, including SemRush (api.semrush.com), DataForSEO (api.dataforseo.com), and SerpAPI (serpapi.com).
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Untrusted data enters the agent context via API responses from SerpAPI (specifically related_questions snippets and organic_results) and SemRush keyword expansions, which reflect content from the public web.
  • Boundary markers: The instructions do not define delimiters or provide specific guidance to the agent to ignore instructions embedded within the retrieved search data.
  • Capability inventory: The skill has access to the bash tool (via curl) and the ability to write reports to the filesystem.
  • Sanitization: There is no evidence of content sanitization, filtering, or escaping for the data retrieved from external search snippets before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 03:57 AM