Keyword Rank Monitor

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 1.0.0

Overview

This is a coherent Chinese SEO keyword-monitoring skill with expected external data-analysis behavior and no evidence of hidden, destructive, or deceptive actions.

Before installing, use an isolated Python environment and consider pinning dependency versions. Treat ranking and competitor data as business-sensitive, and make sure any platform queries or monitoring comply with the relevant platform terms.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-25
Vulnerability Type: Unpinned third-party dependencies without integrity verification
Risk Level: Medium

Vulnerable Code

yaml

        [
          {
            "id": "requests",
            "kind": "pip",
            "package": "requests",
            "label": "安装依赖：pip3 install requests",
          },
          {
            "id": "pandas",
            "kind": "pip",
            "package": "pandas",
            "label": "安装依赖：pip3 install pandas",
          },

Technical Analysis

The skill installation metadata requests the requests and pandas packages without exact version constraints or cryptographic hashes. Consequently, dependency resolution selects whatever compatible release is available from the configured Python package index at installation time.

This makes installations non-reproducible and prevents verification that the installed artifacts are the versions reviewed by the skill author. If the configured package index, dependency resolution path, package release, or a transitive dependency is compromised, installation may introduce attacker-controlled code. Python packages can execute code through build backends or installation hooks, while malicious package content can also execute when imported at runtime.

The package names themselves correspond to established projects, and the artifact does not specify an untrusted package index. Therefore, no active dependency-confusion or typosquatting attack is demonstrated; the confirmed weakness is the absence of version pinning and integrity controls.

Attack Path

1. A user or automated skill manager installs the dependencies declared in SKILL.md.
2. The installer resolves requests and pandas using mutable, unconstrained package specifications.
3. A compromised package release, transitive dependency, mirror, index configuration, or build artifact i ...[truncated 666 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version, such as requests==X.Y.Z and pandas==A.B.C.
2. Generate and commit a lockfile that records all transitive dependencies.
3. Require cryptographic hashes for downloaded distributions, for example through a hash-locked requirements file and pip install --require-hashes.
4. Use the official Python Package Index or a controlled internal mirror, and explicitly restrict trusted package sources.
5. Prefer prebuilt, reviewed wheels and disable unnecessary source builds where operationally feasible.
6. Install dependencies inside an isolated virtual environment using a non-privileged account.
7. Add automated dependency vulnerability scanning and a controlled update process so pinned versions receive reviewed security updates.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description, usage examples, and output are entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. This can violate language or locale policy when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation example "帮我找护肤品的长尾关键词" is a natural, everyday request rather than a narrowly scoped activation phrase. The document provides examples but no explicit trigger boundaries or exclusion conditions, which could cause unintended invocation when users casually ask for keyword ideas.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The markdown describes tracking rankings across platforms and comparing competitor keywords, but it does not warn users that the skill may query external platforms or process competitive/business data. For a markdown skill description, user-facing disclosure about data/privacy and external-service interaction is expected when behavior could affect privacy or platform compliance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.