SEO GEO for SaaS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:06 AM UTC
• Version: 1.0.2

Overview

This SEO skill is mostly purpose-aligned, but it asks for broad credentials and CMS access without enough scoping or secret-handling safeguards.

Install only if you are comfortable supervising it closely. Prefer manual exports or narrowly scoped read-only tokens, do not paste secrets into chat or project files, avoid WordPress admin credentials, and review the planned seo/ file changes before allowing writes or publishing actions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10

Finding

Unconditional Requirements for Multiple Third-Party Credentials Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10-17
Vulnerability Type: Excessive credential requirements
Risk Level: Medium

Vulnerable Code

yaml

requires:
  env:
    - GOOGLE_CLIENT_ID
    - GOOGLE_CLIENT_SECRET
    - GOOGLE_REFRESH_TOKEN
    - DATAFORSEO_LOGIN
    - DATAFORSEO_PASSWORD
  bins:
    - curl

Technical Analysis

The Skill declares Google OAuth credentials and DataForSEO account credentials as unconditional environment requirements. However, its documented workflows allow users to select SemRush, DataForSEO, or manual data sources. Requiring credentials for multiple providers regardless of the selected workflow violates the principle of least privilege.

Environment variables may be accessible to the agent runtime and tools or companion Skills operating in that environment. Reusable OAuth secrets, refresh tokens, and API credentials therefore become part of the runtime's exposure surface even when they are unnecessary for the current task.

The audited repository does not contain credential-exfiltration logic. The risk arises from unnecessarily exposing sensitive credentials to a broader execution context than the declared workflow requires.

Attack Path

1. A user enables the Skill and configures every environment variable declared as required.
2. The user selects a workflow that does not require one or more of those credentials, such as manual data analysis or SemRush CSV processing.
3. The unused credentials nevertheless remain available in the agent or tool execution environment.
4. A compromised companion Skill, unsafe tool, or separate prompt-injection vulnerability in the same runtime reads the exposed environment variables.
5. The obtained credentials are reused against the corresponding external service, subject to their configured scopes and provider-side access controls.

Impact Assessment

A successful secondary compromise could expose Google ...[truncated 464 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove unconditional credential requirements from the Skill metadata.
2. Request credentials only after the user selects the corresponding provider.
3. Make Google and DataForSEO credentials mutually optional rather than jointly mandatory.
4. Prefer short-lived, narrowly scoped tokens over reusable account credentials.
5. Use read-only OAuth scopes for analytics and search-performance analysis.
6. Do not expose secrets to companion Skills or subprocesses unless they explicitly require them.
7. Document credential storage, rotation, revocation, and logging requirements.
8. Redact secrets from command output, generated files, diagnostic messages, and audit logs.
9. Support manual exports without requiring any provider credentials.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/onboarding.md:62

Finding

WordPress REST API Access Is Requested Without Defining Minimum Required Privileges

Content

View full analysis

Vulnerability Details

File Location: references/onboarding.md:62
Vulnerability Type: Unscoped CMS access request
Risk Level: Medium

Vulnerable Code

markdown

### Framer / CMS connection
- If Framer: check for MCP Framer tools (mcp__claude_ai_Framer_MCP__*)
- If Next.js: ask for the blog directory path
- If WordPress: ask for admin URL and REST API access
- For any CMS: understand the publishing workflow (where do articles go? how are they deployed?)

Technical Analysis

The onboarding workflow directs the agent to request a WordPress administration URL and REST API access but does not specify whether access must be anonymous, read-only, author-level, or capable of publishing. It also provides no restrictions regarding credential type, endpoint scope, storage, or duration.

SEO analysis generally requires only public site data or narrowly scoped read access. Content publishing may require write access, but that privilege should be requested separately and only after explicit user authorization. Combining general onboarding with an unspecified CMS access request can lead users to provide credentials with broader permissions than necessary.

The repository does not contain code that uses WordPress credentials maliciously. The finding concerns the unsafe access-request design and its failure to enforce least privilege.

Attack Path

1. During onboarding, the agent asks a WordPress user for an administration URL and REST API access.
2. Because the Skill does not prescribe a limited role or token scope, the user supplies a broadly privileged application password or equivalent credential.
3. The credential becomes available to the agent runtime or a connected CMS tool.
4. A compromised tool, companion Skill, or prompt-injection condition causes unauthorized REST operations.
5. Depending on the supplied account permissions, the attacker reads non-public CMS data or modifies and publishes site ...[truncated 494 chars]

Remediation

View remediation

Remediation Suggestions

1. Use public pages, sitemaps, and exported CMS data for initial analysis whenever possible.
2. State that WordPress administrator credentials must never be supplied.
3. Separate read-only analysis authorization from content-publishing authorization.
4. Require a dedicated WordPress service account with the minimum necessary role.
5. Use a narrowly scoped application password or token that can be revoked independently.
6. Request write access only immediately before an explicitly approved publishing operation.
7. Require confirmation before creating, updating, deleting, or publishing any CMS resource.
8. Do not persist CMS credentials in generated seo/ files, logs, article drafts, or conversation output.
9. Document token expiration, rotation, revocation, and incident-response procedures.
10. Where supported, restrict access to the required REST endpoints and operations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is extremely broad and includes common terms like "blog post," "write an article," and "content strategy," which can cause this skill to activate for generic writing or marketing requests outside its intended scope. Over-broad invocation increases the chance the agent will access SEO-related files, request credentials, or initiate workflows the user did not explicitly ask for.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that onboarding creates and updates multiple files in the user's project, but it does not require an explicit warning or consent checkpoint before local modification. In an agent setting, silent project writes can surprise users, overwrite existing work, or create persistent artifacts that affect later agent behavior without informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill tells the user to configure DataForSEO credentials as environment variables, but provides no safety guidance on secret handling, storage, scope, or redaction. In practice, users may paste credentials into chat, commit them to source control, or expose them to downstream tools, creating a risk of credential leakage and third-party account abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to create and continuously update multiple files under seo/ in the user's project, but it does not require explicit user confirmation before making those filesystem changes. In an agent setting, this can lead to unintended modification of project contents, overwriting existing work, or creating persistent artifacts the user did not knowingly approve.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example DataForSEO calls explicitly set location_name="United States", which imposes a U.S. locale in the methodology without offering any user choice or noting that the locale should be selected based on the target market. This is a natural-language policy concern because it can steer users toward a specific geography by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.