Security audit

geo-prospect

Security checks for vulnerabilities and agentic risk

Overview

This CRM skill matches its stated purpose, but it should be reviewed because it persistently stores contact and business data and lacks clear controls around local file permissions and domain-based file or command handling.

Install only if you are comfortable with a local plaintext CRM under ~/.geo-prospects containing prospect contacts, notes, audit details, and deal values. Use careful, normal domain values only, review generated paths before saving audits or proposals, and protect or delete the storage directory if the machine is shared or backed up to places others can access.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:103
Finding: Unvalidated Domain Input Used in Shell Commands and File Paths
Content: View full analysis
` 1. Run `/geo quick ` to get GEO snapshot score 2. Save score to prospect record: `geo_score`, `audit_date` 3. Save audit output to `~/.geo-prospects/audits/-.md` 4. Update `audit_file` path in prospect record 5. Add auto-note: "Quick audit run. GEO Score: XX/100." 6. If score < 55: suggest "Score indicates strong sales opportunity. Run `/geo proposal ` to generate proposal." ``` The Skill also enables Bash and presents direct CLI invocation patterns: ```markdown allowed-tools: Read, Write, Bash, Glob ``` ```bash seogeo crm add example.com --name "Example Corp" --email hi@example.com \ --stage lead --value 4800 --json seogeo crm show example.com --json seogeo crm audit example.com --score 62 --report ./example-audit/GEO-AUDIT-REPORT.md ``` ### Technical Analysis The Skill accepts an `id-or-domain` or `domain` value from the user and directs a Bash-capable Agent to use that value in both commands and generated filenames. It does not require hostname validation, shell-safe argument handling, path normalization, or containment checks. Two security problems can result: 1. **Command injection:** If an implementation constructs a shell command by interpolating the supplied domain, shell metacharacters may be interpreted as additional commands, substitutions, redirections, or pipelines. 2. **Path traversal:** The audit filename is constructed directly from the supplied domain. Values containing directory separators or traversal components could resolve outside `~/.geo-prospects/audits/`. The project contains only instructional Markdown, so command injection depends on the Agent or downstream implementation performing dire ...[truncated 1402 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:45
Finding: Sensitive CRM and Contact Data Stored in Plaintext Without Required Permission Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are broad enough that the skill may activate on common business words like 'client', 'lead', 'pipeline', or 'crm' even when the user did not intend to use this skill. Because the skill can write persistent prospect and contact data, unintended invocation can lead to accidental collection, storage, or modification of business records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly stores prospect and contact data persistently, including emails, notes, deal values, and audit history, but does not require a clear user warning or consent at collection time. This creates privacy and data-governance risk because users may disclose personal or commercially sensitive information without understanding it will be retained across sessions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: This workflow instructs the agent to create and maintain a persistent CRM database across sessions. Persistent state is not inherently unsafe, but in this context it stores contact identities, emails, notes, and revenue estimates, so unintended retention or reuse of prior-session data can affect privacy and data integrity.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
### `/geo prospect new <domain>` 1. Check if `~/.geo-prospects/prospects.json` exists, create if not (empty array) 2. Auto-detect company name from domain (e.g., `electron-srl.com` → `Electron Srl`) 3. Assign next sequential ID: `PRO-001`, `PRO-002`, etc. 4. Ask user for:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The instruction to create persistent directories for audits and proposals reinforces long-term retention of potentially sensitive customer and prospect information on disk. Saved audit reports and proposal files may contain confidential business assessments or contact details, increasing exposure if the local environment is shared or not properly secured.
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
└── electron-srl.com-proposal.md

text
Create directory if it does not exist: `mkdir -p ~/.geo-prospects/audits ~/.geo-prospects/proposals` ---

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The main command/docs sections define the pipeline stage as proposal and describe the lifecycle as Lead → Qualified → Proposal Sent → Won → Lost, but the tooling section says fixed stages are lead, qualified, proposal_sent, won, lost. This is an active contradiction in the file's own intent documentation and can cause the documented /geo prospect status behavior to diverge from the actual CLI semantics.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.