seo-dataforseo
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the user to execute a local shell script located at
./extensions/dataforseo/install.shto install the extension. - [PROMPT_INJECTION]: The skill processes untrusted content from external sources (SERPs, YouTube comments, and page scrapers), which creates a surface for indirect prompt injection.
- Ingestion points: Untrusted data is ingested via tools such as
on_page_content_parsing,serp_organic_live_advanced, andai_optimization_chat_gpt_scraperinSKILL.md. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard potential commands found within the retrieved data.
- Capability inventory: The skill is configured to allow high-privilege tools including
Bash,Write, andWebFetch. - Sanitization: The instructions do not define any sanitization or validation protocols for the content fetched from external domains.
Audit Metadata