ClawHub
Back to skill

Security audit

geo-report-pdf

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent PDF generator, but its documented shell and browser steps process report content in unsafe ways that warrant review before installation.

Install only if you trust the GEO-AUDIT-REPORT.md inputs and are comfortable with the agent running pandoc and Chrome locally. Before use, remove Chrome --no-sandbox where possible, avoid processing reports from untrusted parties, validate or escape all metadata passed to shell commands, restrict embedded resources, and choose output names deliberately to avoid overwriting existing files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:38
Finding

Shell Command Injection Through Untrusted Report Metadata

Content
View full analysis
" \ --metadata brand_name="" \ --metadata domain="" \ --metadata geo_score="" \ --metadata score_label="" \ --metadata date="" \ --metadata business_type="" \ --metadata locations="" \ --metadata platform="" \ -o GEO-REPORT.html ``` Replace `` placeholders with values extracted in Step 2. ``` ### Technical Analysis The workflow instructs the agent to extract metadata from `GEO-AUDIT-REPORT.md` and substitute it directly into a Bash command. The metadata is therefore untrusted input. Wrapping substituted values in double quotes does not make them safe for shell evaluation. Bash still evaluates command substitutions such as `$(command)` and backtick substitutions inside double-quoted strings. Embedded quote characters may also terminate the intended argument and introduce additional shell syntax. For example, a malicious report could cont ...[truncated 1320 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:77
Finding

Untrusted HTML Rendered with the Chrome Sandbox Disabled

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:54
Finding

Unrestricted Resource Resolution During Pandoc Embedding

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
version: 2.0.0
author: seo-geo-skill
tags: [geo, pdf, report, client-deliverable, professional]
allowed-tools: Read, Grep, Glob, Bash, Write
---

# GEO PDF Report Generator (pandoc pipeline)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The main skill documentation repeatedly states that PDF generation works by running pandoc and then Chrome headless, including explicit pandoc commands in L53-L72 and prerequisites in L15-L18. But L138-L141 says there is no pandoc dependency and that Markdown is converted in-process, which directly contradicts the described implementation and could mislead users about required tooling and behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The markdown explains that the workflow produces GEO-REPORT.html and GEO-REPORT.pdf, but it does not explicitly warn the user up front that existing files with those names in the current directory may be created or overwritten. For a skill that affects local files, a brief disclosure helps users understand the impact before running it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.