ClawHub
Back to skill

Security audit

seo-geo

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SEO/GEO audit helper that may fetch public site data and write a local report, with no evidence of hidden, destructive, or credential-seeking behavior.

Install this as an SEO/GEO audit skill, not a general AI-search assistant. Expect it to fetch public website data, use available SEO/DataForSEO tools if configured, and create a local GEO-ANALYSIS.md report; review before letting it write or replace llms.txt or other site files.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrase list contains broad terms such as "AI search," "Perplexity," and "AI visibility" that can match many unrelated user intents, causing this skill to activate outside its narrow GEO use case. Over-broad invocation can route user requests into network-heavy or file-writing behavior unexpectedly, increasing the chance of unintended actions and misleading analysis.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The skill instructs the agent to generate `GEO-ANALYSIS.md` without telling the user that it will write a file to the workspace. Undisclosed file creation can surprise users, overwrite expected artifacts, or create persistent outputs containing fetched content or analysis they did not explicitly consent to store.

Static analysis

No suspicious patterns detected.