ClawHub
Back to skill

Security audit

geo-update

Security checks across malware telemetry and agentic risk

Overview

This skill is an updater that openly changes installed agent skills, but its broad default update scope and remote shell installer deserve review before use.

Install only if you want this skill to update the seogeo CLI and overwrite bundled SEO + GEO skills across detected agent tools. Prefer a dry run or a single explicit target first, and avoid using it from vague update requests.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
98% confidence
Finding
The standalone trigger "aggiorna" is extremely vague and could match ordinary conversational Italian for "update," causing this privileged update workflow to run without clear user intent. In this skill, such accidental activation is more dangerous because execution includes downloading and piping remote installer scripts into a shell and modifying multiple agent tool skill directories.

Vague Triggers

High
Confidence
98% confidence
Finding
The standalone trigger "aggiorna" is extremely vague and could match ordinary conversational Italian for "update," causing this privileged update workflow to run without clear user intent. In this skill, such accidental activation is more dangerous because execution includes downloading and piping remote installer scripts into a shell and modifying multiple agent tool skill directories.

Self-Modification

High
Category
Rogue Agent
Content
---
name: geo-update
description: Update the installed SEO + GEO skills and the seogeo CLI to the latest release. Reports the installed version, the latest published version, what changed, and reinstalls the skill set across every detected agent tool. Use when the user says "update geo", "update skills", "upgrade seogeo", "aggiorna", or asks whether a newer version exists.
license: MIT
allowed-tools:
  - Bash
Confidence
97% confidence
Finding
update skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.