seo-competitors
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local scripts located at
~/.claude/skills/seo/scripts/, includingpreflight.sh,domain_overview.py, andkeyword_research.py, to perform domain analysis and credential verification. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by interpolating user-provided inputs like
<domain>and<competitor>directly into shell commands. - Ingestion points: User input for domain targets in
SKILL.md. - Boundary markers: No delimiters are used in the shell command templates.
- Capability inventory: Uses the
Bashtool to execute Python and Shell scripts with user-supplied arguments. - Sanitization: There is no evidence of input validation or sanitization before the data is passed to the shell scripts.
Audit Metadata