dataforseo-backlinks-api
Pass
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONNO_CODE
Full Analysis
- Prompt Injection (LOW): The SKILL.md file contains user prompt examples designed to trigger the agent to install the skill (e.g., 'If you don't have the skill installed, install dataforseo-backlinks-api'). This can be used to influence the agent's behavior regarding skill management and bypass explicit user consent for installation.- Data Exposure & Exfiltration (LOW): The skill documentation and REFERENCE.md file describe the transmission of API login and password credentials (HTTP Basic Auth) to api.dataforseo.com. While this is the intended service endpoint, it is not a predefined trusted domain for data transmission.- Metadata Poisoning (LOW): The skill's metadata claims to be generated with 'OpenAI GPT-5.2', which is a non-existent model version. This provides inaccurate and misleading provenance information.- Indirect Prompt Injection (LOW):- Ingestion points: The skill retrieves backlink data and anchor text from the DataForSEO API (api.dataforseo.com) and displays it to the agent.- Boundary markers: No delimiters or instructions to ignore embedded commands within the API response are specified in the integration contract.- Capability inventory: The skill enables the agent to perform outbound network requests and process external data structures.- Sanitization: There are no instructions or mechanisms provided to sanitize or validate the external API payload before it enters the agent's context.
Audit Metadata