local-gmb-visibility
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes authorized tool calls to SE Ranking and Planable MCPs to perform its tasks. There are no signs of malicious code, unauthorized network requests, or credential theft.
- [SAFE]: Includes a dedicated 'Connector health check' section that instructs the agent to verify authentication and connectivity with external services before executing commands, preventing errors and ensuring a secure environment.
- [SAFE]: Demonstrates awareness of resource limits and stability by providing instructions on how to handle large JSON responses from SEO tools (e.g., using specific query parameters or filtering tools like
jq). - [PROMPT_INJECTION]: The skill's architecture creates a surface for indirect prompt injection as it processes external rankings and competitor data to generate social media content drafts.
- Ingestion points: External SEO data and competitor information are retrieved using SE Ranking tool calls as described in
SKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from obeying commands potentially embedded in the fetched SEO data.
- Capability inventory: The skill allows the creation and labeling of social media posts in Planable (e.g.,
create_post,create_grouped_post) as outlined inSKILL.md. - Sanitization: No specific data validation or sanitization steps are provided for the content retrieved from external sources before it is used in the creation of social media posts.
Audit Metadata