Content Quality Auditor

Security checks across malware telemetry and agentic risk

Overview

This is mostly a content-auditing prompt, but it tells the agent to automatically save audit blockers and priorities into persistent memory without user confirmation.

Install only if you are comfortable with the agent auditing drafts and potentially saving audit findings into memory. Before using it on private or sensitive content, ask the agent not to write to `memory/hot-cache.md`, `memory/open-loops.md`, or `memory/audits/content/` unless you explicitly approve.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI06: Memory and Context Poisoning
Medium
What this means

Private draft issues, publish blockers, or improvement tasks could be saved into shared memory and reused in future sessions without the user approving that storage.

Why it was flagged

The skill explicitly directs persistent memory writes and removes user confirmation, which can store draft/content-audit details and influence later agent behavior.

Skill content
**Promotes**: veto items and publish blockers to `memory/hot-cache.md` (auto-saved, no user confirmation needed). Top improvement priorities to `memory/open-loops.md`.
Recommendation

Ask the user before saving audit findings to memory, provide an opt-out, keep summaries minimal, and document how users can review or delete saved memory entries.

#
ASI01: Agent Goal Hijack
Low
What this means

The agent may audit newly produced content automatically or with minimal prompting, which could add extra analysis steps the user did not explicitly ask for.

Why it was flagged

The instruction can shift the agent into an audit workflow after writing or editing content, even without a separate audit request. This fits the skill purpose but users should be aware of the automation.

Skill content
**PostToolUse hook recommendation**: after content is written or substantially edited, the command-backed hook may recommend this audit. When hook-triggered, skip setup questions — audit the content that was just produced.
Recommendation

Treat hook-triggered audits as recommendations and confirm before proceeding when the user has not clearly requested an audit.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

The skill's detailed scoring or safety behavior may depend on remote documentation that can change independently of the installed skill.

Why it was flagged

The reviewed package includes only a local item reference, while key benchmark, security, contract, and state-model references are linked to remote GitHub main-branch documents that were not included in the artifact set.

Skill content
Full benchmark reference: [references/core-eeat-benchmark.md](https://github.com/aaron-he-zhu/seo-geo-claude-skills/blob/main/references/core-eeat-benchmark.md)
Recommendation

Package the referenced benchmark and policy files with the skill or pin links to immutable commit hashes so users know exactly which instructions are being used.