dataforseo-onpage-api
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOWPROMPT_INJECTIONNO_CODE
Full Analysis
- Indirect Prompt Injection (LOW): The skill enables an agent to crawl untrusted external websites, which could contain malicious prompts designed to influence the agent's logic or summaries. Ingestion points: HTML content, titles, and meta tags from external sites via the DataForSEO API. Boundary markers: No delimitation or isolation instructions are provided to separate external content from system instructions. Capability inventory: Summarization, reporting, and identifying site regressions. Sanitization: No content validation or sanitization mechanisms are specified.
- Data Exposure & Exfiltration (LOW): The skill performs network operations to 'api.dataforseo.com'. While this is the intended purpose, the domain is not on the whitelist of trusted external sources. No sensitive local file access or exfiltration patterns were detected.
- Metadata Poisoning (LOW): The 'generated_with' field in SKILL.md claims usage of 'OpenAI GPT-5.2', which is a non-existent model version, making the metadata deceptive.
- No Code (INFO): The skill consists entirely of instructional markdown and integration references. No executable scripts, binaries, or package dependencies were found.
Audit Metadata