Security checks for vulnerabilities and agentic risk
Overview
This is a marketing skill that openly helps brands audit and optimize for AI recommendations, with some credential-handling and disclosure caveats users should understand.
Install only if you are comfortable with a marketing workflow that sends brand, category, competitor, and query data to external AI providers. Use environment variables for API keys, avoid command-line or config-file secrets, do not audit confidential or unauthorized domains, and review generated comparison content for accuracy and clear sponsorship disclosure before publishing.
The script supports two insecure alternatives to environment-based secret handling:
A Perplexity API key may be supplied through the --api-key command-line argument.
Perplexity and OpenAI API keys may be loaded from ordinary JSON configuration properties.
Command-line secrets can be captured in shell history, terminal transcripts, process-monitoring telemetry, job-runner logs, and—depending on the operating system and configuration—process listings visible to other local users. Plaintext configuration secrets may be exposed through permissive file permissions, backups, support bundles, workspace sharing, or accidental source-control commits.
The configuration behavior also conflicts with the Skill metadata statement that API keys are loaded from environment variables.
Attack Path
A user invokes the script with a command such as:
bash
Alternatively, the user places perplexityApiKey or openaiApiKey in aeo-config.json.
The secret remains in shell history or operational logs, is visible in process metadata while the command runs, or persists in the plaintext configuration.
A local user, monitoring service, workspace recipient, or party with access to an accidentally committed configuration obtains the credential.
The exposed credential is reused against the
...[truncated 474 chars]
Remediation
View remediation
Remediation Suggestions
Remove support for the --api-key argument.
Remove config.perplexityApiKey and config.openaiApiKey as credential sources.
Read API credentials exclusively from environment variables or an approved secret manager:
js
If interactive credential entry is necessary, use a masked prompt and retain the value only in memory.
Explicitly reject credential-related properties in configuration files to prevent accidental plaintext storage.
Add documentation warning users not to place credentials in configuration files or command-line arguments.
Add relevant configuration filenames to .gitignore, enforce restrictive file permissions where configuration may contain sensitive business data, and enable repository secret scanning.
Rotate any API credential previously supplied through a command line or committed to a configuration file.
Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
- Node.js v18+ (for the `answer-intent-map.js` script)
Ae1
High
Category
analysis-evasion
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected
Content
Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
- Node.js v18+ (for the `answer-intent-map.js` script)
Ae1
High
Category
analysis-evasion
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected
Content
Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
- Node.js v18+ (for the `answer-intent-map.js` script)
Ae1
High
Category
analysis-evasion
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected
Content
Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
- Node.js v18+ (for the `answer-intent-map.js` script)
Hidden Instructions
High
Category
Prompt Injection
Confidence
89% confidence
Finding
The HTML comment contains hidden instructions telling authors how to craft text for AI systems to quote favorable brand messaging verbatim. Hidden prompt-like directives are especially risky because they are not visible to normal readers but may still be ingested by tooling, content pipelines, or agents that process raw markup.
Content
Scanner excerpt · templates/answer-hub-template.md (reported line 11)May include surrounding context.
md
---
<!--
IMPLEMENTATION NOTES (delete before publishing):
This TL;DR section is the most important element on the page.
Hidden Instructions
High
Category
Prompt Injection
Confidence
86% confidence
Finding
This hidden section instructs authors to build 'topical authority' and depth specifically to signal helpfulness to AI models, rather than solely to inform readers. As hidden guidance embedded in the template, it can covertly shape generated content and downstream retrieval or ranking behavior without transparent disclosure.
Content
Scanner excerpt · templates/answer-hub-template.md (reported line 142)May include surrounding context.
md
---
<!--
HOW TO CHOOSE NOTES (delete before publishing):
This section builds topical authority and adds depth that signals to AI models
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The README instructs users to configure API keys and query external AI platforms but does not disclose that prompts, domains, and competitive/business data may be transmitted to third-party services. This creates a real privacy and data-governance risk, especially if users audit non-public brands, internal sites, or sensitive client information under the assumption processing is local.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The instruction to run an audit on a domain implies automated analysis of a target website without warning that site/brand details may be processed by external AI providers. In a marketing skill aimed at competitive intelligence and brand optimization, users may submit client or internal domains, making undisclosed third-party transmission more dangerous in context.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The template explicitly instructs authors to make a page appear neutral while engineering copy that AI models will quote verbatim in favor of the brand. This is a form of semantic influence designed to manipulate downstream assistant outputs and can mislead users into receiving promotional content as if it were impartial guidance.
Content
No source excerpt is available for this finding.
Ssd 1
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
These hidden notes are semantically manipulative: they tell authors to construct content that sounds neutral while being optimized for branded quotation by AI systems. Because the instructions are hidden from readers, the persuasive intent is concealed, increasing deception risk and reducing informed user consent.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The instruction to write the TL;DR exactly as the author wants ChatGPT to say it is a direct attempt to steer assistant phrasing and recommendations. This bypasses normal editorial neutrality and seeks to implant brand-preferred wording into downstream AI answers without user awareness.
Content
No source excerpt is available for this finding.
Ssd 4
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The template advises using honest-looking competitor coverage to build trust so AI models treat the page as credible guidance. This gradual trust-building narrative is dangerous because it launders promotional content through signals of objectivity, increasing the likelihood of biased recommendations being treated as authoritative.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The competitor guidance presents inclusion of rivals as a credibility tactic to increase AI trust and capture comparison traffic, rather than for genuine balance. This encourages deceptive framing of marketing content as objective analysis, which can bias AI systems and users who rely on apparent neutrality.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
Across the decision and FAQ sections, the template repeatedly tells authors to use wording users ask AI assistants so models may quote the page. This is intentional query-shaping aimed at influencing assistant responses and recommendations, especially where the content promotes the author's own brand as the top choice.
Content
No source excerpt is available for this finding.
Ssd 4
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The FAQ section incrementally optimizes for exact assistant-query matching to improve quotation probability, which is a subtle but deliberate steering mechanism. In context, this sits inside a branded recommendation template, so the optimization meaningfully increases the risk that assistants surface biased commercial content as neutral help.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Low
Category
Not specified by scanner
Confidence
91% confidence
Finding
The FAQ notes direct authors to mirror exact AI-user phrasing to increase the chance that assistants quote the page. While SEO-style query matching is common, here it is explicitly aimed at steering model responses toward branded content, which creates a manipulation risk beyond ordinary discoverability optimization.
