Security audit

seo-cluster

Security checks across malware telemetry and agentic risk

Overview

This SEO skill is mostly coherent, but its execution mode can create, overwrite, and modify local content files without clear confirmation or backup safeguards.

Install only if you are comfortable with a skill that can write and edit SEO content files in the current working directory when execution is invoked. Run it in a dedicated project folder, review `cluster-plan.json` before execution, and keep version control or backups for drafts because overwrite and backlink-injection safeguards are not clearly documented.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill goes beyond analysis/planning and can trigger downstream content-generation execution via another installed skill. That expands the trust boundary from passive SEO planning into autonomous file-writing and multi-step orchestration, which increases the chance of unintended actions, unsafe prompt chaining, or abuse if input or imported plans are manipulated.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The security section claims URL fetching always occurs through `seogeo render` with SSRF protection, but the documented workflow actually uses WebSearch and optionally DataForSEO for SERP retrieval. This mismatch can cause operators to rely on protections that may not apply in practice, leading to unsafe assumptions, incomplete review of network behavior, and potential exposure if future steps ingest arbitrary URLs under a false sense of safety.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow explicitly instructs the agent to open and modify previously written post files to inject links, but it does not require user confirmation, preview, backups, or any scope restrictions. In an automation context, silent edits to existing content can unintentionally overwrite curated text, introduce unwanted links, or alter production content in ways the user did not approve.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The resume logic says incomplete spoke files should be treated as unwritten and recreated, but it does not require preserving or reviewing the existing content first. This creates a direct risk of destructive overwrite or loss of partially completed human-authored work, especially because the incompleteness heuristic is simplistic and may misclassify valid drafts.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: Generating `cluster-scorecard.md` is a file write operation without any warning about creation or overwrite behavior. While lower risk than content regeneration, it can still clobber an existing manually maintained scorecard or write into an unexpected location if execution context is unclear.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.