seo-profound

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:54 AM UTC
• Version: 1.0.0

Overview

This SEO tracking skill is mostly coherent, but it asks the agent to inspect a Claude settings file before every tool call, which can expose unrelated credentials or private configuration.

Review this skill before installing. It should be changed to check only whether PROFOUND_API_KEY exists in the current environment immediately before Profound API use, without reading or exposing the full Claude settings file. Do not run the referenced installer scripts unless you can separately inspect and trust them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:18

Finding

Excessive Access to Agent-Wide Configuration Containing Sensitive Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Sensitive configuration access beyond least-privilege requirements
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- Before any tool call, check `~/.claude/settings.json` has `env.PROFOUND_API_KEY`.

Technical Analysis

The skill instructs the agent to inspect the complete Agent-wide ~/.claude/settings.json file before every tool call merely to determine whether PROFOUND_API_KEY exists. This configuration file may contain unrelated environment variables, credentials, hooks, integration settings, or other sensitive Agent configuration.

Accessing the entire settings file exceeds the minimum privileges required for the stated task. The skill only needs to know whether the Profound API key is available; it does not need access to unrelated settings or the key's plaintext value. Requiring this access before every tool call also broadens the exposure window beyond Profound-specific operations.

The file does not explicitly instruct the agent to transmit or disclose the configuration contents. Therefore, this finding represents unnecessary sensitive-resource access and increased exposure risk, rather than confirmed credential exfiltration.

Attack Path

1. A user or Agent loads the skill and requests an operation.
2. The Agent follows the prerequisite instruction before making a tool call.
3. The Agent reads ~/.claude/settings.json to locate env.PROFOUND_API_KEY.
4. Unrelated credentials and configuration values from that file may enter the active model, tool, or logging context.
5. Those values could subsequently be exposed through accidental output, retained tool logs, or later prompt-driven misuse.

No explicit exfiltration destination or malicious transmission mechanism is present in the audited file, so the final exposure step is conditional rather than directly implemented.

Impact Assessment

T ...[truncated 685 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to read the complete ~/.claude/settings.json file.
2. Check only whether PROFOUND_API_KEY is present in the current process environment, without printing, logging, or returning its value.
3. Perform the check only immediately before a Profound API request rather than before every tool call.
4. Use a narrowly scoped credential provider or secret manager that returns availability status without exposing the secret to the model context.
5. Ensure diagnostic messages report only that the key is configured or missing; they must never include the key value.
6. Document the minimum required permission and prevent the skill from accessing unrelated Agent configuration.
7. Add the referenced installer scripts to the auditable package or remove those references. The current project references extensions/profound/install.sh and install.ps1, but those files were not present and their credential-handling behavior could not be reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- Run `extensions/profound/install.sh` or `install.ps1`.
- Profound API key.
- Before any tool call, check `~/.claude/settings.json` has `env.PROFOUND_API_KEY`.

## Routing

Static analysis

No suspicious patterns detected.