seo-keyword-research
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the standard Python
requestslibrary to communicate with the SerpApi backend. This is a well-known package used for its intended purpose. - [COMMAND_EXECUTION]: The workflow involves executing a Python script (
blog_seo_research.py) and usingcurlto fetch data fromserpapi.com. These operations are consistent with the skill's documented SEO research functionality. - [INDIRECT_PROMPT_INJECTION]: The skill has a potential surface for indirect injection as it processes data from an external API.
- Ingestion points: Untrusted data enters the agent context through the
USER_TOPICinput and the subsequent JSON responses from the Google Trends API viaserpapi.com. - Boundary markers: No specific delimiters or boundary markers are used to separate the API-returned data from the agent's internal instructions.
- Capability inventory: The skill has access to the
Bashtool for running Python and curl, as well as theReadtool. - Sanitization: The Python script parses the JSON response into specific fields (e.g., query, growth value) but does not apply sanitization or escaping to the string values before they are incorporated into the blog outline.
Audit Metadata