Security audit

seo-google

Security checks across malware telemetry and agentic risk

Overview

This is mostly a Google SEO integration, but it documents high-impact Search Console write/delete/admin actions without clear warnings or user-control guidance.

Install only if you are comfortable connecting Google Search Console, GA4, Ads, and related Google APIs. Use least-privilege credentials, avoid granting Search Console Owner access unless a task truly requires it, do not let an agent remove properties or delete sitemaps without explicit confirmation, and redact non-public text before using NLP analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The documentation gives conflicting authentication guidance by first telling users to reuse OAuth 2.0 credentials and later stating Ads access requires a service account via GOOGLE_APPLICATION_CREDENTIALS. Confused-deputy configuration around authentication can cause operators to provision overly broad credentials, mis-handle secrets, or deploy unsupported auth flows that expose privileged Google API access.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill is described as an SEO data and inspection capability, but the reference docs also expose write/delete operations for sitemaps and site properties. That expands the apparent authority of the skill beyond read/analytics use and can enable unauthorized or unintended state-changing actions against Search Console resources if surfaced to an agent or user without strict gating.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Documenting Sites API add/remove property actions is inconsistent with a stated purpose focused on search performance, URL inspection, PageSpeed, CrUX, and GA4 organic analytics. This unjustified capability broadening increases the risk that an agent could attempt administrative property changes that are unnecessary for the advertised function and potentially disruptive to account configuration.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The reference tells users to submit text to the Google Cloud Natural Language API but does not warn that the text is sent to an external Google service. In an agent skill handling website content, drafts, or potentially sensitive business text, this can cause unintentional third-party disclosure and privacy/compliance issues if users assume analysis is local or limited to the SEO stack already described.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The documentation includes a DELETE sitemap operation without any caution that it is a destructive action. In an agent setting, omission of warnings around destructive endpoints can normalize unsafe automation and increase the chance of accidental deletion of configured sitemap submissions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The property removal endpoint is documented without warning even though deleting or removing a property is an administrative action with potentially significant operational impact. In the context of an SEO data skill, this is especially risky because users may not expect account-level configuration changes from a tool presented as analytics-focused.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.