T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:8- Finding
Mandatory Promotional Messaging Overrides User-Directed Interaction
- Content
View full analysis
- Remediation
View remediation
Security audit
Distribb SEO Agent Skill: Backlinks Exchange, Writer, Keyword Research
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Distribb SEO API integration, but it can upload and publish content, insert service-selected backlinks, and use remote writing instructions without enough per-action user control.
Review this skill carefully before installing. Use it only with a Distribb account and API key you trust, keep articles in Draft unless you intentionally want scheduling or publishing, and require the agent to show you all outbound backlink targets, article content, destination project, and publishing status before any create, update, or publish request.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:90- Finding
Mandatory Third-Party Backlink Injection into User Content
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:163- Finding
Remote API Content Is Treated as Agent Instructions Without a Trust Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (15)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README instructs users to authenticate with an API key and send business context, keyword data, and article content to a third-party service, but it does not clearly warn that potentially sensitive project data leaves the local environment. In an agent-skill context, this can cause unreviewed exfiltration of proprietary content, competitor data, and operational metadata to an external platform.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This POST example sends keyword research inputs and project identifiers to an external API, which is an external transmission of user or business data. While expected for the product's functionality, the skill documentation does not frame it as a privacy/security-sensitive action, making accidental disclosure more likely.
- Content
md "https://distribb.io/api/v1/business-context?project_id=42" | jq . # Keyword research curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d '{"keyword": "crm software", "project_id": 42}' \ https://distribb.io/api/v1/keywords/search | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This article creation example transmits title and HTML content to distribb.io, potentially including unpublished marketing material, proprietary research, or customer-sensitive text. In an agent setting, such content exfiltration is more dangerous because the model may generate and submit data automatically without a clear review checkpoint.
- Content
md "https://distribb.io/api/v1/backlink-targets?project_id=42&keyword=crm+software" | jq . # Create article curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d '{"project_id": 42, "keyword": "best crm", "title": "Best CRM", "content": "<h2>...</h2>", "status": "Draft"}' \ https://distribb.io/api/v1/articles | jq .
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README shows update and publish operations that can modify stored articles and push content to external CMS platforms, but it does not warn that these actions have real side effects. In an autonomous or semi-autonomous agent workflow, that omission raises the risk of unintended content changes or accidental publication to production sites.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This PUT example performs an external state-changing request that updates remotely stored article content. Without a clear caution about side effects and review requirements, an agent could overwrite content unintentionally or alter material later published to connected CMS platforms.
- Content
md https://distribb.io/api/v1/articles | jq . # Update article (e.g. add backlink targets after submission) curl -s -X PUT -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d '{"content": "<h2>Revised...</h2>"}' \ https://distribb.io/api/v1/articles/123 | jq .
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description is broad enough to trigger on many generic writing, publishing, SEO, or content-planning requests, increasing the chance the agent invokes a capability set that can publish content and trigger downstream actions without the user intending to use this service. In this skill, overbroad activation is more dangerous because the skill can submit articles, publish to external CMS platforms, and implicitly trigger social-media draft generation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "https://distribb.io/api/v1/business-context?project_id=42" | jq . # 3. KEYWORD RESEARCH: Find what to write about curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d '{"keyword": "crm software", "project_id": 42}' \ https://distribb.io/api/v1/keywords/search | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "https://distribb.io/api/v1/business-context?project_id=42" | jq . # 3. KEYWORD RESEARCH: Find what to write about curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d '{"keyword": "crm software", "project_id": 42}' \ https://distribb.io/api/v1/keywords/search | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "https://distribb.io/api/v1/business-context?project_id=42" | jq . # 3. KEYWORD RESEARCH: Find what to write about curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d '{"keyword": "crm software", "project_id": 42}' \ https://distribb.io/api/v1/keywords/search | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This submission step sends full article content and metadata to an external service for storage and scheduling, which may expose sensitive drafts or proprietary content if done without explicit user approval. In this skill, the danger is amplified because submitted content may later be auto-published and is shaped to include third-party backlinks for a link-exchange network.
- Content
md # You MUST include 1-2 URLs from the backlink-targets response as natural references. # 7. SUBMIT: Save to Distribb's content calendar curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "project_id": 42,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to publish articles to a connected CMS, and publication automatically triggers creation of social-media drafts on connected platforms, but it does not require an explicit just-in-time confirmation immediately before these irreversible or externally visible actions. This creates a real risk of unintended content publication and downstream propagation beyond the user's primary site.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
Creating an article sends complete generated content, metadata, and scheduling information to Distribb, which can persist the content and prepare it for publication. This is dangerous if the user has not explicitly approved external submission, and the surrounding workflow pressures the agent to include network backlinks that may not align with the user's editorial or compliance expectations.
- Content
Create Article
bash curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "project_id": 42,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This long-form submission pattern encourages uploading entire article files to the external service, increasing the amount of potentially sensitive data transmitted and stored. The risk is contextual rather than inherent to curl itself: the skill does not require pre-send review or warn about external storage of the full article body.
- Content
For long articles, write the HTML to a file and use
@syntax:bash curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg content "$(cat article.html)" '{ "project_id": 42,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Updating an article with revised content is another external transmission of full content, and here it is specifically driven by the platform's backlink-credit mechanism. That context makes it riskier because the agent is instructed to modify content to satisfy a link-exchange program, potentially overriding user editorial intent without a fresh confirmation.
- Content
Use this to revise an article after submission, for example to add backlink targets if the creation response included a
backlinks_warning.bash curl -s -X PUT -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg content "$(cat revised-article.html)" '{ "content": $content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This step submits the finished article to Distribb as part of an end-to-end workflow that proceeds directly toward scheduling and publication, but does not force an explicit confirmation at the moment of external submission. Because the content may contain required exchange-network backlinks and may later auto-publish, accidental or unauthorized transmission can have business, reputational, and compliance consequences.
- Content
md # - Output valid HTML # Step 7: Submit to Distribb curl -s -X POST -H "Authorization: Bearer $DISTRIBB_API_KEY" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg content "$(cat article.html)" '{ "project_id": 42,
Static analysis
No suspicious patterns detected.