Security audit

Cashclaw Seo Auditor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real SEO auditor, but it needs review because it can fetch unrestricted URLs, write to arbitrary output paths, and installs an unpinned npm package.

Install only in an isolated environment with no access to internal networks, cloud metadata services, or sensitive writable project files. Use it only for domains you are authorized to audit, direct outputs to a dedicated deliverables directory, avoid overwriting existing files, and prefer a pinned/reviewed CashClaw package version before trusting the installed `cashclaw` binary.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:194
Finding: Mandatory Third-Party Branding Injection in Generated Reports
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/audit.js:300
Finding: Server-Side Request Forgery Through Unrestricted Audit URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/audit.js:381
Finding: Arbitrary Writable-File Overwrite Through Unvalidated Output Path
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned npm Package Installation Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code does perform SEO auditing, so the general domain matches the description. However, the description overstates the breadth and outputs. The implementation is a relatively narrow single-URL technical/on-page auditor using simple HTML parsing and a few response-header checks. It does not analyze off-page SEO signals (e.g., backlinks, authority, citations, social signals), does not provide substantial performance analysis beyond basic timing/compression/page size, and does not generate prioritized recommendations—only pass/fail checks and scores. Therefore, the declared description is materially broader than the actual behavior.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
node scripts/audit.js --url "https://example.com" --output audit-data.json

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill directs the agent to make outbound network requests via node scripts/audit.js, curl, and cashclaw audit, but it does not declare any permissions or allowed-tools scope. Missing explicit tool scoping can cause agents or platforms to execute broader network activity than users expect, reducing transparency and policy enforcement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs writing reports and raw audit data into the workspace deliverables/ directory without warning the user or requiring confirmation. Unannounced file writes can surprise users, overwrite existing artifacts, or persist sensitive scanned data about third-party sites in shared workspaces.
Content: No source excerpt is available for this finding.