Security audit

seo-geo-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill’s setup purpose is clear, but it relies on unpinned internet scripts and broadly modifies agent tool installations, so it should be reviewed before use.

Install only if you trust the publisher and the referenced GitHub repository. Prefer a version-pinned or signed installer workflow, run a dry-run first, and choose a single target such as codex instead of all unless you intentionally want every detected agent tool modified. Treat future updates with the same caution because the update command repeats the remote script execution pattern.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:44
Finding: Mutable Remote Installers Are Executed Directly by Shells
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:140
Finding: Update Procedure Re-executes an Unpinned Remote Script
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The shell pipeline into sh removes the user's opportunity to inspect the downloaded content before execution and turns content retrieval directly into command execution. In an agent skill context, this is especially risky because it normalizes high-trust execution patterns that an automated assistant might relay or run with minimal review.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
macOS and Linux:

bash
curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh

Windows PowerShell:

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This update command again chains untrusted network content directly into shell execution, preserving the same abuse path during maintenance operations. Update paths are often run repeatedly and with less scrutiny, which increases exposure if the upstream source is ever compromised.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
bash
seogeo --version curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh seogeo install --target all

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
To target one tool:

bash
seogeo install --target claude # ~/.claude/skills seogeo install --target codex # ~/.codex/skills seogeo install --target gemini # ~/.gemini/extensions/seo-geo-skill seogeo install --target opencode # ~/.config/opencode/skills

External Script Fetching

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs the agent to download a remote script and immediately execute it via a shell pipeline. Even with a note to ask for user consent, this creates a supply-chain and remote-code-execution risk because any compromise of the hosting location, repository, or transport trust chain would result in arbitrary code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
macOS and Linux:

bash
curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh

Windows PowerShell:

External Script Fetching

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The update instructions repeat the same pattern of fetching and executing a remote script in one step. This is dangerous for the same reason as the initial install path: an attacker controlling the remote content or release flow could execute arbitrary commands during update.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
bash
seogeo --version curl -fsSL https://raw.githubusercontent.com/asale-ai/seo-geo-skill/main/install.sh | sh seogeo install --target all

Static analysis

No suspicious patterns detected.