local-gmb-visibility

Pass

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill utilizes authorized tool calls to SE Ranking and Planable MCPs to perform its tasks. There are no signs of malicious code, unauthorized network requests, or credential theft.
  • [SAFE]: Includes a dedicated 'Connector health check' section that instructs the agent to verify authentication and connectivity with external services before executing commands, preventing errors and ensuring a secure environment.
  • [SAFE]: Demonstrates awareness of resource limits and stability by providing instructions on how to handle large JSON responses from SEO tools (e.g., using specific query parameters or filtering tools like jq).
  • [PROMPT_INJECTION]: The skill's architecture creates a surface for indirect prompt injection as it processes external rankings and competitor data to generate social media content drafts.
  • Ingestion points: External SEO data and competitor information are retrieved using SE Ranking tool calls as described in SKILL.md.
  • Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from obeying commands potentially embedded in the fetched SEO data.
  • Capability inventory: The skill allows the creation and labeling of social media posts in Planable (e.g., create_post, create_grouped_post) as outlined in SKILL.md.
  • Sanitization: No specific data validation or sanitization steps are provided for the content retrieved from external sources before it is used in the creation of social media posts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 25, 2026, 01:08 PM
Security Audit — agent-trust-hub — local-gmb-visibility