backlink-opportunity-planner
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the DataForSEO API, including referring domains, anchor text, and backlink records, which could contain hidden instructions intended to manipulate the agent.
- Ingestion points: Data fetched from the DataForSEO API via
scripts/dfs_client.py. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the external data are present.
- Capability inventory: The skill executes several Python scripts (
dfs_client.py,project_memory.py,report_publish.py) to process data and generate PDF/HTML reports. - Sanitization: While the skill qualifies prospects by link type, it does not specify a mechanism for sanitizing or escaping raw text strings retrieved from the API before agent processing.
- [COMMAND_EXECUTION]: The skill relies on the execution of local scripts to perform its primary functions, including data retrieval and report generation.
- Evidence: Execution calls for
scripts/dfs_client.py,scripts/project_memory.py, andscripts/report_publish.py.
Audit Metadata