Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly behaves like a bounded public website audit tool, but it includes an under-disclosed local engine override that can execute arbitrary Python in the plugin context.
Review this before installing if the plugin will run in an environment where untrusted users or processes can set environment variables or write near the plugin directory. The website-scanning behavior itself is bounded and disclosed, but the engine override should only be used in a trusted runtime. Also check the output directory before enabling saved reports, and remember the quotability score is English-biased.
The plugin dynamically imports and executes Python from GEO_SCAN_ENGINE or fallback file locations without any trust validation. In an agent/plugin environment, anyone able to influence environment variables or place files in searched paths can achieve arbitrary code execution in the tool's security context, which is far beyond the stated GEO-audit purpose.
The skill advertises network, file read/write, and environment-related operational capabilities but does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, this can lead to over-broad execution authority, making it easier for the skill to be invoked with unintended side effects such as writing files or performing network access beyond the user's expectation.
The phrase "any GEO, AEO or AI-SEO audit request" is a broad natural-language trigger without clear boundaries or exclusion examples. In a skill description, this can cause unintended invocation for loosely related requests that mention audits or SEO without actually asking for this specific website-scanning behavior.
The natural-language limitation "Quotability heuristics are English-only" imposes a language-specific behavior and may disadvantage non-English content without user opt-in. The policy allows locale constraints when they are clearly justified as region-specific or when users are given a choice, which is not present here.
The docstring says the repo root/plugin directory contains exactly one copy of the scoring code, implying a fixed local engine. In reality, _engine_path() accepts GEO_SCAN_ENGINE and also falls back to _HERE / "engine.py" and _HERE.parent / "geo_scan.py", so the code may load and execute different files than the documentation suggests.
The manifest/registered description emphasizes a read-only audit of public websites, but the handler has a save mode that creates directories and writes report files locally. Local file output is not mentioned in the top-level skill description, so the actual behavior exceeds the stated read-only audit scope.
The scanner sends every request with a fixed Accept-Language: en,en-US;q=0.8,de;q=0.6 header, which imposes specific locale preferences regardless of the user's own language settings or consent. This matches the policy category for language/locale policy violations because the file does not offer a user choice or document this as a justified region-specific constraint.
The string "English phrase lists only" is a natural-language locale restriction embedded in the file. Because this is presented as part of the evaluation evidence with no indication of user choice or a documented region-specific reason, it suggests an English-only policy that can violate language/locale requirements.
The text explicitly says the tool's quotability heuristics are English-only and that non-English pages score near zero on that check. This is a natural-language locale policy concern because it hard-codes a language preference rather than offering a user choice or opt-in.
The quotability heuristics are built from English-only phrases, and the code later acknowledges that non-English pages will be under-scored. Because the tool applies this scoring by default without user opt-in or multilingual alternatives, it embeds a language bias that can disadvantage non-English content.
This is a manifest file, so SQP-2 applies to its markdown-style description content. The description says the skill can write reports to disk, but it does not warn about where files are written, whether existing files may be overwritten, or that local filesystem changes will occur.
Detected: suspicious.dynamic_code_execution
