Security audit

geo

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed GEO/SEO reporting tool, but it also includes broad activation, persistent prospect storage, and a self-update command that can change future skill behavior without clear safeguards.

Review this skill before installing if you only want GEO/SEO analysis. Use it deliberately with /geo commands, avoid storing client or prospect data unless you accept local persistence under ~/.geo-prospects, and do not run /geo update unless you have reviewed the upstream changes you are about to apply.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The skill materially expands beyond GEO/SEO analysis into CRM data management, proposal generation, client progress tracking, and self-update behavior. This broadens the trust boundary from analysis into persistent data handling and code/content supply-chain changes, increasing the chance of unintended file writes, privacy issues, and unsafe execution paths.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: A CRM-lite prospect management feature is unrelated to the core GEO audit purpose and introduces persistent storage of potentially sensitive business/contact data in the user's environment. This increases privacy and data-governance risk because a user invoking an SEO tool may not expect local prospect databases or sales-pipeline state to be created or modified.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: A self-update command that pulls from an upstream repository introduces a supply-chain risk: external content can change the skill's behavior after installation without the user reviewing the new instructions. In an agent context, update features are especially sensitive because they can alter future tool use, permissions expectations, or embedded workflows.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The PDF workflow invokes local executables (pandoc and headless Chrome) and processes generated content into local files, which goes beyond simple analysis and introduces execution and file-generation risk. While likely intended for reporting convenience, this expands the attack surface through shell commands, browser automation flags, and dependence on locally installed software.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger criteria are overly broad, including generic terms like 'optimize' and any URL, which can cause the skill to activate in contexts the user did not intend. Over-broad activation increases the chance that a high-permission skill with read, write, bash, and web access is invoked unnecessarily, expanding exposure and surprise side effects.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents writes to persistent files under the user's home directory without prominently warning that data will be stored locally. Hidden or non-obvious persistence is risky because users may disclose client or prospect information expecting transient analysis, not durable local record creation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The update command performs an upstream pull without a clear warning, meaning the skill may fetch and apply changed content from outside the local trust boundary. Because updates can silently modify future behavior, this is more dangerous than ordinary data retrieval and should be treated as a high-trust operation.

Static analysis

No suspicious patterns detected.