The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to access a sensitive local credential file located at ~/.config/dataforseo/auth. This path is used to retrieve authentication tokens for API requests.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute curl commands. It demonstrates patterns where user-provided input (such as <domain>, <keyword>, and <query>) is directly interpolated into shell commands. This creates a significant risk of command injection if the user provides malicious payloads containing shell metacharacters.
[DATA_EXFILTRATION]: The skill reads the contents of the local auth file and transmits it as an Authorization header to an external domain (api.dataforseo.com). While necessary for the intended service, this pattern of reading local secrets and sending them over the network is inherently risky.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from external API responses (such as raw LLM responses from Google, ChatGPT, and Claude) and user queries without using boundary markers or sanitization, potentially allowing malicious content to influence the agent's subsequent actions via its Bash and Read capabilities.

30x-seo-ai-visibility