seo-dataforseo
Pass
Audited by Gen Agent Trust Hub on Feb 14, 2026
Risk Level: LOWEXTERNAL_DOWNLOADS
Full Analysis
- EXTERNAL_DOWNLOADS (LOW): The skill requires the installation of 'dataforseo-client' and 'python-dotenv' from PyPI. These are standard packages for the service and are used as intended for API interaction and environment management.
- INDIRECT_PROMPT_INJECTION (LOW): The skill processes data from the DataForSEO API and writes results to local JSON and Markdown files. Because it ingests external content that could be influenced by third parties (e.g., search results or keyword metadata) and provides this data back to the agent, it possesses an indirect prompt injection surface. 1. Ingestion points: API responses from search engines and keyword databases via DataForSEO. 2. Boundary markers: None. Data is stored in structured JSON or summarized in Markdown files. 3. Capability inventory: File write access to the 'results/' directory; no arbitrary command execution or external network operations beyond the defined API endpoints. 4. Sanitization: Filenames are sanitized using a whitelist approach in 'scripts/core/storage.py' to prevent directory traversal. The API content itself is not sanitized before being saved.
Audit Metadata