geo-update

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.1

Overview

This update skill is coherent but uses unsafe remote installer execution and defaults to persistent changes across every detected agent tool.

Install only if you trust the publisher and are comfortable with the updater replacing a local CLI and overwriting bundled skills across detected agent tools. Prefer reviewing or pinning the installer first, running a dry run, and targeting a single agent tool instead of `--target all`.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:34

Finding

Direct Execution of a Mutable Remote Shell Installer

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 34
Vulnerability Type: Remote payload retrieval and execution through curl | sh
Risk Level: High

bash

curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh

Technical Analysis

The Skill instructs the agent to download install.sh from the mutable main branch of an external GitHub repository and pipe it directly into sh. The downloaded content is neither pinned to an immutable commit nor inspected or independently authenticated before execution.

The claim that the installer verifies release checksums does not secure this initial execution step. The installer itself is outside the audited project, and a compromised or malicious installer could remove, alter, or bypass its own checksum verification.

Although installing a missing toolkit legitimately requires obtaining software, executing mutable network content directly in a shell is not the minimum-privilege or minimum-trust mechanism necessary to accomplish that task.

Attack Path

1. An attacker compromises the repository owner, repository, GitHub workflow, or mutable main branch.
2. The attacker replaces install.sh with a malicious payload.
3. A user invokes this Skill on a system where seogeo is not installed.
4. The agent runs the documented curl command.
5. sh executes the attacker-controlled response immediately, without local review or independent verification.
6. The payload performs arbitrary actions using the invoking user's permissions.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user running the Skill. The payload could read or modify user-accessible files, credentials, shell configuration, installed binaries, and agent configuration. If the agent is running with elevated privileges, the impact could extend to system-wide modification.

The surrounding workf ...[truncated 295 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | sh execution pattern.
• Download the installer to a local file without executing it.
• Pin the download to an immutable release version or commit rather than main.
• Verify the installer against a trusted, independently obtained checksum or a cryptographically signed release manifest.
• Inspect or audit the downloaded installer before execution.
• Execute it only after explicit user confirmation.
• Avoid elevated execution unless a specific installation destination requires it.
• Prefer installing a signed release artifact through a trusted package manager where available.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56

Finding

Toolkit Upgrade Executes an Unpinned Remote Shell Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 56
Vulnerability Type: Remote payload retrieval and execution through curl | sh
Risk Level: High

bash

curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh

Technical Analysis

The upgrade procedure downloads an installer from an external repository's mutable main branch and executes the response directly with sh. Review of the Skill cannot establish what code this command will execute in the future because the referenced content may change independently of the audited project.

No immutable version, commit hash, trusted local digest, or signature verification is applied before shell execution. Any checksum verification performed by the downloaded installer occurs too late to establish trust in the installer itself.

Replacing an installed binary may be necessary for the declared update functionality, but arbitrary execution of mutable remote script content exceeds the trust and privilege needed for a secure update process.

Attack Path

1. An attacker gains the ability to modify the referenced install.sh or influence the content returned by its hosting account.
2. The user asks the agent to update the toolkit.
3. The agent confirms that a newer release exists and runs the documented upgrade command.
4. The remote response is sent directly to sh.
5. The malicious installer executes with the user's permissions and may replace the existing binary or perform unrelated commands.
6. Subsequent seogeo install --target all execution could consume a compromised replacement binary and affect multiple detected agent environments.

Impact Assessment

The attacker could obtain arbitrary code execution under the invoking account. Potentially accessible scope includes user files, API configuration, credentials available to the process, installed command-line tools, and skill directories belonging to detec ...[truncated 352 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable main-branch URL with a versioned, immutable release artifact.
• Separate download and execution into distinct, reviewable steps.
• Authenticate the artifact before execution using a signed manifest or a checksum anchored in an independent trusted channel.
• Ensure the updater cannot verify itself solely through attacker-controlled metadata.
• Preserve the existing binary until all verification succeeds, then use an atomic replacement operation.
• Default to updating one explicitly selected agent target.
• Require informed confirmation before applying changes through seogeo install --target all.
• Run the updater with ordinary user privileges and narrowly restrict writable destinations.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61

Finding

PowerShell Upgrade Executes Mutable Remote Content with Invoke-Expression

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–62
Vulnerability Type: Remote payload retrieval and execution through irm | iex
Risk Level: High

powershell

irm https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.ps1 | iex

Technical Analysis

The Windows installation path uses Invoke-RestMethod (irm) to retrieve PowerShell source from the mutable main branch and sends it directly to Invoke-Expression (iex). Invoke-Expression evaluates the returned text as PowerShell code immediately.

The remote script is not included in the audited project, pinned to an immutable revision, or authenticated before execution. A statement that the script checks release artifacts cannot establish the integrity of the script performing that check.

This pattern gives the external source control over commands executed on the user's Windows session and is not necessary for a secure update. A downloaded and independently verified installer can provide the same declared functionality with substantially less supply-chain risk.

Attack Path

1. An attacker modifies install.ps1 in the referenced repository or compromises an account capable of doing so.
2. A Windows user requests an upgrade.
3. The agent runs the documented irm ... | iex command.
4. PowerShell retrieves the attacker-controlled text.
5. Invoke-Expression executes that text without prior inspection or independent authentication.
6. The payload acts with the privileges and environmental access of the PowerShell process.

Impact Assessment

Exploitation permits arbitrary PowerShell execution as the invoking user. The payload could access user-readable data, environment variables, credentials available to the process, PowerShell profiles, local agent configuration, and writable executable locations. It could also replace seogeo, causing later apparently legitimate commands to run attacker-controlled behavior ...[truncated 241 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the irm | iex pattern.
• Download the PowerShell installer to a local file from an immutable, versioned release.
• Validate an Authenticode signature or a cryptographically signed release manifest before execution.
• Compare the artifact against an independently trusted digest.
• Review the downloaded script and execute it with -File only after explicit approval.
• Use a restrictive PowerShell execution context and avoid administrator privileges unless demonstrably required.
• Log the selected version, verified digest, source URL, and installation destinations for auditability.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

This skill is explicitly designed to update the installed CLI and reinstall skills across all detected agent tools, which is a form of self-modification. Even if intended as maintenance, self-updating agent components can change future agent behavior and trust boundaries, especially when combined with remote installation steps.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: geo-update
description: Update the installed SEO + GEO skills and the seogeo CLI to the latest release. Reports the installed version, the latest published version, what changed, and reinstalls the skill set across every detected agent tool. Use when the user says "update geo", "update skills", "upgrade seogeo", "aggiorna", or asks whether a newer version exists.
license: MIT
allowed-tools:
  - Bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh pipeline creates a direct command-execution chain from network input to the shell with no opportunity for integrity validation or human review. In context, this is especially dangerous because the command is presented as the remediation path when the toolkit is missing, increasing the chance it will be run immediately.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

the install command rather than trying to repair the installation:

bash

curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh

---

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This command chains remote content directly into shell execution during the update process, creating a high-risk arbitrary code execution path. Because the skill then reinstalls skills across multiple detected agent tools, successful exploitation could alter both the local system and downstream agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

The install script is idempotent and replaces the binary in place:

bash

curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh

On Windows PowerShell:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use the skill when the user says "update skills," which is broad and not clearly limited to the SEO/GEO toolkit. In many agent contexts, users may ask to update unrelated skills, making unintended invocation more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Step 2 — Check for a newer release

bash

curl -fsSL https://api.github.com/repos/asale-ai/seo-geo-skill/releases/latest \
  | grep '"tag_name"'

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to fetch and execute a remote shell script directly from GitHub using curl ... | sh, which bypasses meaningful review of the downloaded code at execution time. If the remote content, repository, DNS, or transport trust is compromised, this results in immediate arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

the install command rather than trying to repair the installation:

bash

curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh

---

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This is the same unsafe remote-script execution pattern in the actual upgrade path, making the skill depend on live execution of mutable remote code. Because this step upgrades a binary that later manages skills across agent tools, compromise here can propagate malicious changes broadly.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

The install script is idempotent and replaces the binary in place:

bash

curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh

On Windows PowerShell: