Seo Blog Writer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:03 AM UTC
• Version: 2.2.0

Overview

The skill is mostly a disclosed blog-writing and publishing workflow, but it needs review because it recommends unpinned external installs and unbundled publishing scripts that may handle CMS access.

Install only if you are comfortable reviewing and pinning the optional dependencies first. Prefer the static or draft-only path, use least-privilege CMS credentials, inspect any local scripts before running the publish commands, and avoid live publish flags until the generated post and target platform settings are confirmed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned npm Package Is Downloaded and Immediately Executed

Content

View full analysis

"The **ai-seo MCP** (`@automatelab/ai-seo-mcp`) is not connected. Step 5 can run a programmatic citation-worthiness and schema score on your draft in addition to the manual audit. To install it: > ``` > npx -y @automatelab/ai-seo-mcp > ``` > then register it in your MCP config. See the [ai-seo-mcp README](https://github.com/AutomateLab-tech/ai-seo-mcp) for one-line configs for Claude Code, Cursor, and Cline. Type **skip** to continue with the manual-only audit." ``` ### Technical Analysis The instruction invokes `npx` with the `-y` option and no exact package version. This causes npm to resolve the package from the configured registry, download the currently selected release, and execute its entry point without an interactive installation confirmation. The effective executable can therefore change after this Skill has been reviewed. A compromised maintainer account, malicious future release, registry compromise, or dependency-chain compromise could cause arbitrary code to run under the invoking user's identity. The MCP is explicitly optional and is not required for the core drafting or manual auditing workflow. Automatically executing its latest registry version therefore exceeds the minimum privilege and dependency requirements of the Skill's core functionality. ### Attack Path 1. An attacker compromises the `@automatelab/ai-seo-mcp` package, one of its transitive dependencies, or the associated registry publishing account. 2. The attacker publishes a malicious release that is selected by npm's unpinned version resolution. 3. A user follows the Skill's installation prompt and runs: ```bash npx -y @automatelab/ai-seo-mcp ``` 4. `npx` downloads and executes the compromised package without displaying an interactive confirmation. 5. The malicious package ...[truncated 761 chars]

Remediation

View remediation

``` 2. Record and verify the expected package integrity hash and registry provenance. 3. Use a lockfile for any persistent installation and commit the lockfile for review. 4. Review the package and its transitive dependencies before recommending execution. 5. Remove `-y` from user-facing instructions where feasible so package resolution and installation require explicit confirmation. 6. Run the optional MCP in a sandbox with restricted filesystem, environment-variable, and network access. 7. Keep the manual-only audit as the default path and install the MCP only after explicit, informed user consent. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:611

Finding

Unpinned Python Dependencies Permit Unreviewed Package Updates

Content

View full analysis

Remediation

View remediation

PyJWT== ``` 2. Generate and verify cryptographic hashes, then install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use an isolated virtual environment rather than modifying a shared or system Python environment. 4. Commit a reproducible lockfile generated by a dependency-management tool such as `pip-tools`. 5. Restrict installation to a trusted package index and validate package provenance. 6. Audit transitive dependencies and update pinned versions through a controlled review process. 7. Include the referenced publishing adapter implementations in the distributed artifact so their imports, credential handling, and network behavior can be audited. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for an end-to-end editorial automation and publishing system. The supplied code does none of that. It is purely a frontend enhancement script that runs in the browser, injects tooltip CSS, scans links containing /glossary/, adds a glossary-term class, and sets target/_blank and rel/noopener for certain links. Its primary purpose, triggers, and behavior are materially unrelated to blog-post generation, source research, SEO/schema auditing, or publishing adapters. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: seo-blog-writer
description: "Turn a single long-tail query into a publish-ready blog post that ranks in search and gets quoted by AI assistants. Runs the full pipeline: classify the topic, research it against real sources, draft clean HTML, scrub LLM-tell vocabulary and typography, audit for AI-SEO (TL;DR block, query-phrased H2s, FAQ section, FAQPage + BreadcrumbList + HowTo JSON-LD), then publish through a platform adapter (Ghost Admin API, WordPress REST, or static-site file output). Platform-agnostic core; swap the publish step without rewriting the writing pipeline. Built for indie hackers, founders, an

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

command -v python3

2. Working directory writable

mkdir -p tmp/blog-drafts && touch tmp/blog-drafts/.touch && rm tmp/blog-drafts/.touch

text

**3. (Optional) ai-seo MCP — check before continuing**

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

# ellipsis -> three dots
t = t.replace('…', '...')
# zero-width / non-breaking space -> regular space or empty
t = t.replace('​', '').replace(' ', ' ')
p.write_text(t, encoding='utf-8')
print('scrubbed', sys.argv[1])
" tmp/blog-drafts/<slug>.draft.html

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger language is broad enough that ordinary requests to write or publish content could invoke a skill that performs research, file writes, optional tool installation prompting, and publishing actions. Over-broad activation increases the risk of unintended execution of a high-impact workflow, especially where platform credentials are already configured.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to install and run an MCP server via npx -y @automatelab/ai-seo-mcp without pinning a specific package version or integrity source. That creates a supply-chain risk: a future compromised or malicious package release would be executed automatically in the user's environment during setup.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest focuses on research, drafting, SEO audit, schema generation, and platform publication. Adding site-interactive glossary tooltips and requiring deployment of a JavaScript asset changes site behavior beyond producing a publish-ready article, making this capability broader than the declared editorial purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest description presents the pipeline as turning one query into one new blog post, with publishing as the final adapter step. However, the documented implementation expands the pipeline to inspect existing site content and query CMS post inventories to build interlinks, which is additional operational behavior beyond the core description of drafting and publishing a single post.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.