Seo Blog Writer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 2.2.0

Overview

The skill mostly matches its stated blog-writing purpose, but it asks users to run unpinned third-party tools and suggests administrator-level WordPress credentials.

Install only if you are comfortable giving the agent draft and publishing authority. Prefer the static target or draft-only CMS mode, pin and review any MCP or Python dependencies before running them, and use a dedicated low-privilege WordPress/Ghost integration account rather than an administrator account.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned Third-Party Package Download and Execution

Content

View full analysis

"The **ai-seo MCP** (`@automatelab/ai-seo-mcp`) is not connected. Step 5 can run a programmatic citation-worthiness and schema score on your draft in addition to the manual audit. To install it: > ``` > npx -y @automatelab/ai-seo-mcp > ``` > then register it in your MCP config. See the [ai-seo-mcp README](https://github.com/AutomateLab-tech/ai-seo-mcp) for one-line configs for Claude Code, Cursor, and Cline. Type **skip** to continue with the manual-only audit." ``` Related unpinned Python dependency installation appears at `SKILL.md:611`: ```bash pip install requests pyjwt ``` ### Technical Analysis The Skill instructs the user or Agent to download and execute the currently resolved version of `@automatelab/ai-seo-mcp` using `npx -y`. No exact version, lockfile, package integrity hash, or reviewed artifact is specified. The `-y` option also suppresses the normal installation confirmation. An npm package may execute code through its command entry point and package lifecycle behavior. Consequently, the effective code executed by this instruction can change after the Skill itself has been reviewed. The unpinned pip dependencies present a similar reproducibility and supply-chain weakness, although the `npx` command creates the clearest direct execution path. There is no evidence that the named packages are currently malicious. The vulnerability is that the Skill trusts mutable registry content and recommends immediate execution without version or integrity controls. ### Attack Path 1. An attacker compromises the publisher account, package repository, dependency chain, or registry delivery path for the referenced npm package. 2. The attacker publishes a malicious version that remains compatible with the unversioned package name. 3. A user follows the Skill’s preflight ...[truncated 1040 chars]

Remediation

View remediation

``` 2. Prefer installation through a lockfile-backed project rather than ad hoc `npx` execution. 3. Record and verify package integrity information or use a trusted internal package mirror. 4. Remove automatic `-y` behavior and require explicit user approval before downloading or executing third-party code. 5. Pin Python dependencies to reviewed versions and hashes, for example through a requirements lockfile: ```text requests== --hash=sha256: PyJWT== --hash=sha256: ``` 6. Run optional auditing tools in a restricted environment without CMS credentials, unrelated filesystem access, or broad network permissions. 7. Document the exact package provenance and review process so users can verify the dependency before enabling it. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:619

Finding

Overprivileged WordPress Administrator Credential Guidance

Content

View full analysis

Application Passwords -> new -> "seo-blog-writer" | `xxxx xxxx xxxx xxxx xxxx xxxx` | ``` The Skill also associates administrator access with the ability to submit unsanitized HTML at `SKILL.md:648`: ```text - WordPress accepts `

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes an end-to-end content creation and publishing system for SEO blog posts. The supplied code does none of that. It is a front-end enhancement script that runs in the browser, injects tooltip styling, and modifies glossary links in page DOM. Its primary purpose, triggers, and capabilities are materially different from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: seo-blog-writer
description: "Turn a single long-tail query into a publish-ready blog post that ranks in search and gets quoted by AI assistants. Runs the full pipeline: classify the topic, research it against real sources, draft clean HTML, scrub LLM-tell vocabulary and typography, audit for AI-SEO (TL;DR block, query-phrased H2s, FAQ section, FAQPage + BreadcrumbList + HowTo JSON-LD), then publish through a platform adapter (Ghost Admin API, WordPress REST, or static-site file output). Platform-agnostic core; swap the publish step without rewriting the writing pipeline. Built for indie hackers, founders, an

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

command -v python3

2. Working directory writable

mkdir -p tmp/blog-drafts && touch tmp/blog-drafts/.touch && rm tmp/blog-drafts/.touch

text

**3. (Optional) ai-seo MCP — check before continuing**

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

The skill contains a zero-width character literal in the scrubber example, which is a classic hidden-text indicator. Hidden Unicode can conceal logic, alter string matching, or create reviewer confusion; in an agent skill context, such characters are especially risky because they can mask instructions or evade straightforward inspection.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

# ellipsis -> three dots
t = t.replace('…', '...')
# zero-width / non-breaking space -> regular space or empty
t = t.replace('​', '').replace(' ', ' ')
p.write_text(t, encoding='utf-8')
print('scrubbed', sys.argv[1])
" tmp/blog-drafts/<slug>.draft.html

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description contains broad trigger language such as activating on 'any request to ship editorial content for a long-tail query.' Overly broad activation can cause the agent to invoke this skill in contexts the user did not intend, potentially leading to unintended web research, file writes, or publishing workflow steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to install and run an MCP server via npx -y @automatelab/ai-seo-mcp without pinning an exact package version or integrity mechanism. That creates a supply-chain risk: a later compromised or malicious package release could be executed automatically in the user's environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.