seo-action-plan
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites via the Ubersuggest MCP tool (e.g.,
domain_overview,domain_keywords). This creates an attack surface for indirect prompt injection if an analyzed website contains malicious instructions intended to manipulate the agent.\n - Ingestion points: External data enters the context through
domain_overview,domain_keywords,domain_top_pages, andcompetitorstool calls inSKILL.md.\n - Boundary markers: No specific delimiters or warnings are provided to prevent the agent from obeying instructions embedded in the analyzed website data.\n
- Capability inventory: The skill utilizes various analysis tools from the
ubersuggestMCP server to perform traffic analysis, keyword research, and site audits.\n - Sanitization: There is no evidence of sanitization or filtering applied to the data retrieved from external domains before it is processed by the agent.\n- [EXTERNAL_DOWNLOADS]: The skill references the Ubersuggest MCP server at
https://ubersuggest-mcp.neilpatelapi.com/mcpand provides instructions to install theubersuggest/seo-skillsplugin for Claude Code. These resources are provided by the official vendor for the skill's functionality.
Audit Metadata