Security audit

Bytesagain Ecommerce Seo Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local ecommerce copy helper with no network access, credential use, persistence, or destructive behavior found.

Before installing, expect this skill to draft marketplace and SEO text locally from product facts you provide. Review generated claims against official marketplace rules before publishing, especially for compliance-sensitive products.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
bash scripts/script.sh keywords --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
bash scripts/script.sh keywords --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
bash scripts/script.sh keywords --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
bash scripts/script.sh keywords --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
bash scripts/script.sh keywords --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
bash scripts/script.sh keywords --product "portable blender" --channel "Amazon" --features "USB-C charging,400ml cup,easy cleaning" --keywords "portable blender

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a skill for optimizing ecommerce keywords, product copy, listing audits, and search-term planning. The script also implements broader marketing-content generation for short video scripts, livestream cues, captions, localization, compliance checklists, multi-channel bundles, and a 14-day publishing calendar, which goes beyond the narrower SEO/product-copy optimization description.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The description says to use the skill when 'building keyword maps, rewriting titles, improving category text, auditing listings, or planning search terms,' which is a wide set of routine activities and does not define clear boundaries for when the skill should or should not activate. There are no negative examples or narrower trigger constraints to reduce accidental invocation overlap with general writing or marketing assistance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The usage output claims the available commands are only 'keywords rewrite category audit calendar demo help version', but the script actually defines many additional commands such as brief, title, bullets, compare, pdp, seo, faq, hook, script, live, caption, map, localize, tone, compliance, and bundle. This is an active mismatch between the script's documentation/help text and what the code provides.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.