geo-platform-optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent GEO audit/reporting guide, but it requests unrestricted shell access that is not needed for its stated workflow.

Review before installing. The skill appears intended to audit public AI-search visibility and write a report, with no evidence of deception or persistence, but it should ideally remove Bash or constrain it and ask before creating or overwriting GEO-PLATFORM-OPTIMIZATION.md.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:8

Finding

Unnecessary Unrestricted Shell Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 8
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Read, Grep, Glob, Bash, WebFetch, Write

Technical Analysis

The Skill grants access to the unrestricted Bash tool even though its documented workflow only requires collecting public website information, evaluating it, and writing a Markdown report. No Bash command, local executable, or shell-dependent operation is defined anywhere in the Skill.

This violates the principle of least privilege. A general-purpose shell can access local files, inspect environment variables, execute installed programs, create or modify files, start processes, and make network requests with the permissions of the agent runtime. Consequently, any successful prompt injection or unintended instruction that reaches the agent while this Skill is active has access to a substantially broader execution surface than the legitimate task requires.

The configuration does not itself execute a malicious command, and the reviewed Skill contains no explicit instruction to abuse Bash. The vulnerability is the unnecessary exposure of a high-impact capability that can amplify a separate instruction-injection event.

Attack Path

1. A user invokes the Skill to audit a target website.
2. The agent fetches or processes content controlled by the target website or another external platform.
3. The external content contains adversarial instructions intended to influence the agent.
4. If the agent incorrectly follows those instructions, the unnecessary Bash permission provides a local code-execution channel.
5. Commands execute under the operating-system identity and sandbox restrictions of the agent runtime.
6. Depending on those runtime permissions, the commands could inspect accessible files and environment variables, alter workspace data, launch processes, or transmit accessible information over the network. ...[truncated 813 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash from allowed-tools because the documented audit workflow does not require arbitrary command execution:

yaml

allowed-tools: Read, Grep, Glob, WebFetch, Write

2. Apply stricter minimization where practical. If the audit only reads the Skill configuration, fetches public pages, and creates a report, prefer:

yaml

allowed-tools: Read, WebFetch, Write

3. If future functionality genuinely requires command execution, replace unrestricted Bash access with narrowly scoped, parameterized operations that:

   • Permit only explicitly approved commands.
   • Reject shell metacharacters and command substitution.
   • Use fixed argument arrays rather than shell-built command strings.
   • Restrict filesystem access to the audit workspace.
   • Block access to credential files and sensitive environment variables.
   • Apply outbound network allowlists.
   • Run under a dedicated, unprivileged sandbox identity.

4. Treat all fetched website and community-platform content as untrusted data. Add explicit instructions that external content must be analyzed but never interpreted as agent commands.

5. Require confirmation or policy approval before any high-impact operation, and log all command-execution attempts for review.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is very broad and does not define clear trigger boundaries, exclusions, or prerequisites, so an agent may invoke it in situations where the user did not explicitly request platform-specific GEO auditing. Because the skill has broad tool permissions including WebFetch, Bash, and Write, overbroad invocation increases the chance of unnecessary web access, filesystem changes, and unintended side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to generate GEO-PLATFORM-OPTIMIZATION.md, but the description does not warn that running the skill will create or modify a file. This can lead to unexpected workspace changes, especially if the agent auto-invokes the skill or the user expects analysis-only behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.