Security audit

On Page Seo Checker

Security checks for vulnerabilities and agentic risk

Overview

This SEO skill is mostly purpose-aligned, but it expands beyond its stated boundaries by directing extra tool use, connected SEO account data, bulk audits, and E-E-A-T checks despite narrower declarations.

Install only if you are comfortable constraining how the agent uses it: keep audits to user-provided pages or clearly approved URLs, do not allow connected Search Console/SEO-tool access or local helper execution unless you explicitly trust and scope those integrations, and treat CORE-EEAT output as a rough referral signal rather than a publish-readiness judgment.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill declares only WebFetch as an allowed tool, yet its instructions authorize external crawlers, Search Console, SEO tools, and direct execution of local Python helper scripts. This creates a capability mismatch that can induce an agent to exceed the host's security model, potentially accessing local executables, external services, staged sites, or connected account data that were not explicitly permitted for this skill.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The template explicitly adds a 'CORE-EEAT quick scan' even though the skill metadata says this skill is not for E-E-A-T or publish-readiness scoring. This creates scope drift that can cause the agent to perform disallowed analysis, route work incorrectly, and produce outputs users may over-trust as approved publish-readiness judgments.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The content-quality section includes 'E-E-A-T signals' and related publish-readiness style criteria despite the declared scope excluding that domain. In an agent system, this kind of embedded instruction can override manifest intent in practice and lead to unauthorized or misleading evaluations outside the skill's allowed responsibilities.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The 'Technical On-Page' section includes speed, mobile, canonical, and schema items that are adjacent to technical SEO, crawlability, and CWV concerns that the manifest says belong elsewhere. While some overlap is normal, bundling excluded checks into this skill can cause policy boundary erosion and incorrect use of this skill for tasks that should be delegated to the technical-seo-checker.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: This section directly contradicts the manifest boundary by instructing the model to perform and score E-E-A-T-related checks after stating the skill is not for E-E-A-T scoring. Contradictory internal guidance is dangerous in agent systems because operational templates often dominate behavior, causing systematic misuse, misrouting, and false confidence in out-of-scope assessments.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The playbook explicitly expands the skill from its declared single-page on-page audit use into site-wide and bulk auditing. This creates scope drift between the manifest and implementation, which can cause the agent to take actions or produce analyses outside the capability boundaries users and orchestrators expect.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file introduces CORE-EEAT and content-quality style evaluation even though the skill metadata explicitly says this skill is not for E-E-A-T or publish-readiness scoring and should defer to another skill. This can misroute sensitive evaluative work, produce unsupported recommendations, and undermine safety or quality controls that depend on clear skill boundaries.

Static analysis

No suspicious patterns detected.