geo-technical

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent SEO audit helper, but its instructions can lead an agent to run unsafe shell-based web requests against unvalidated user-supplied URLs.

Use this only for sites you control or clearly trust. Prefer WebFetch or safely quoted curl arguments, validate URLs before running requests, block private/link-local/metadata addresses and unsafe redirects, and confirm where GEO-TECHNICAL-AUDIT.md will be written before generating it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:284

Finding

Shell Command Injection Through Unquoted Target URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 284 and 324
Vulnerability Type: Shell command injection caused by unsafe interpolation of attacker-controlled input
Risk Level: High

Vulnerable Code

markdown

1. Fetch the page with curl (no JavaScript execution): `curl -s [URL]`

markdown

- Measure with curl: `curl -o /dev/null -s -w 'TTFB: %{time_starttransfer}s\n' [URL]`

Technical Analysis

The skill directs a Bash-capable agent to collect a URL from the user and substitute it directly into shell commands. The [URL] argument is neither quoted nor validated. If an implementation performs direct textual substitution, shell metacharacters in the supplied URL can terminate or alter the intended curl command.

Because the skill explicitly permits the Bash tool, the resulting command can be interpreted by a system shell rather than passed to curl as a safely isolated argument. Characters used for command separation, command substitution, redirection, or pipelines could therefore cause unintended commands to execute.

The vulnerability is present in both the raw-HTML retrieval command and the TTFB measurement command.

Attack Path

1. An attacker requests an audit for a target value containing shell control syntax rather than a conventional URL.
2. The agent substitutes that value for [URL] in one of the documented curl command templates.
3. The completed command is submitted to the Bash tool without strict validation or argument isolation.
4. Bash interprets the injected shell syntax separately from the intended curl invocation.
5. The injected command runs with the operating-system permissions and filesystem access granted to the agent process.
6. Command output may be returned directly or incorporated into the generated audit, while destructive commands could alter accessible files or project state.

Impact Assessment

Successful exploitation can provide arbitrary command execution within the secur ...[truncated 622 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a structured HTTP-fetching tool such as WebFetch that accepts the URL as a discrete parameter and does not invoke a shell.

2. If curl is required, store the validated URL in a variable and pass it as a quoted argument:

   bash

   curl --silent --show-error -- "$URL"
   

   For timing:

   bash

   curl --output /dev/null --silent --show-error \
     --write-out 'TTFB: %{time_starttransfer}s\n' -- "$URL"
   

3. Parse the input with a standards-compliant URL parser before execution.

4. Permit only the https and, where explicitly necessary, http schemes.

5. Reject credentials in URLs, control characters, malformed encodings, and unexpected shell syntax.

6. Do not construct commands through string concatenation or textual placeholder replacement.

7. Where available, invoke processes through an argument-array API without shell=true.

8. Run network audit operations in a restricted sandbox with minimal filesystem access, no unnecessary credentials, and constrained outbound connectivity.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:18

Finding

Server-Side Request Forgery Through Unrestricted Audit Targets

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–22, 30–33, and 420–422
Vulnerability Type: Server-side request forgery through unrestricted user-selected URLs and derived endpoints
Risk Level: Medium

Vulnerable Code

markdown

## How to Use This Skill

1. Collect the target URL (homepage + 2-3 key inner pages)
2. Fetch each page using curl/WebFetch to get raw HTML and HTTP headers
3. Run through each of the 8 audit categories below
4. Score each category using the rubric
5. Generate GEO-TECHNICAL-AUDIT.md with results

markdown

### 1.1 robots.txt Validity
- Fetch `https://[domain]/robots.txt`
- Check for syntactic validity: proper `User-agent`, `Allow`, `Disallow` directives
- Check for common errors: missing User-agent, wildcards blocking important paths, Disallow: / blocking entire site
- Verify XML sitemap is referenced: `Sitemap: https://[domain]/sitemap.xml`

markdown

### Implementation Check
1. Check for IndexNow key file: `https://[domain]/.well-known/indexnow-key.txt` or similar
2. Check if CMS has IndexNow plugin (WordPress: IndexNow plugin; many modern CMS platforms support it natively)
3. If not implemented, recommend adding it with instructions

Technical Analysis

The skill instructs the agent to fetch a user-selected target and multiple derived resources. It does not require validation of the destination's resolved address, port, protocol, redirect chain, or network classification.

An attacker can therefore select a hostname or URL that points to a loopback, private, link-local, reserved, or otherwise internal address reachable from the agent environment. A public hostname may also resolve to an internal address or redirect to one after an initial validation check. The additional requests for robots.txt, sitemap resources, inner pages, and IndexNow files broaden the set of internal paths that may be queried.

This creates an SSRF primitive in which the auditing environment performs requests ...[truncated 1913 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict audit targets to valid http or https URLs and explicitly approved ports.
2. Resolve the hostname before every request and reject destinations in loopback, private, link-local, multicast, carrier-grade NAT, documentation, benchmark, and other reserved address ranges for both IPv4 and IPv6.
3. Block known cloud metadata destinations and metadata hostnames.
4. Revalidate the resolved destination after DNS lookup and immediately before connection to reduce DNS-rebinding risk.
5. Disable redirects by default. If redirects are required, validate the scheme, host, port, and resolved address at every redirect hop.
6. Apply the same checks to homepage requests, inner pages, robots.txt, sitemaps, IndexNow files, and URLs discovered in response content.
7. Reject alternative or ambiguous IP representations and normalize hostnames before policy evaluation.
8. Enforce connection, total-time, redirect-count, and response-size limits.
9. Use outbound firewall or proxy rules so the audit process can reach only public web destinations.
10. Avoid placing raw internal response bodies or sensitive headers into generated reports.
11. Log blocked requests and validation failures without exposing sensitive internal address details to untrusted users.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 497)May include surrounding context.

md

**Status:** Present / Absent / Not Applicable

<!-- If present: -->
| Relation Type | URL | Meaning |
|---|---|---|
| api-catalog | /.well-known/api-catalog | Machine-readable index of available APIs |

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown skill explicitly tells the agent to generate GEO-TECHNICAL-AUDIT.md, which affects user data/workspace by creating or overwriting a file. The document provides no warning that the skill will write an artifact, so a user reading the skill description is not clearly informed of that behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.