seo-content-brief
Warn
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of an external CLI tool ('belt-sh/cli') via npx and references several external skills from the 'inference-sh' organization. These sources are not recognized as established or trusted vendors, posing a potential supply chain risk if the remote packages are compromised.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to extract and analyze content from top-ranking URLs and search results using 'tavily/extract' and 'exa/search'. This process ingests untrusted data from the open web directly into the agent's context, which could be used to deliver hidden instructions to the LLM.
- Ingestion points: Data returned from 'tavily/search-assistant', 'tavily/extract', and 'exa/search' (SKILL.md).
- Boundary markers: No boundary markers or 'ignore' instructions are provided to help the agent distinguish between search data and its own system instructions.
- Capability inventory: The skill has access to the 'Bash' tool to execute 'belt' commands, allowing it to perform network requests and CLI interactions based on analyzed content.
- Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external URLs before it is passed to the agent.
- [COMMAND_EXECUTION]: The skill makes extensive use of the 'belt' command-line interface to run remote apps. These commands take user-supplied keyword inputs as arguments. Without proper sanitization by the 'belt' utility, this could potentially lead to command injection if the agent interprets maliciously crafted keywords as shell directives.
Audit Metadata