Security audit

SEO Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SEO analyzer, but its bundled script fetches arbitrary unvalidated URLs from the user's environment, which could reach local, private-network, or non-web resources.

Install only if you are comfortable with the agent making network requests from your machine. Use it only on URLs you trust or on already-fetched HTML via stdin, and avoid internal hosts, localhost, cloud metadata addresses, file URLs, and untrusted redirecting links until the script restricts protocols and destinations.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: seo-analyze.sh:7
Finding: Unrestricted User-Controlled URL Fetching Enables SSRF and Local Resource Access
Content: View full analysis
}" HTML=$(curl -sL --max-time 15 -A "Mozilla/5.0 SEO-Analyzer/1.0" "$URL") fi ``` ### Technical Analysis The script accepts a user-controlled URL and passes it directly to `curl` without validating its scheme, destination, resolved IP address, or redirect targets. Consequently, an attacker may cause the host running the skill to request resources that are not normally accessible to the attacker, including: - Loopback services such as `http://127.0.0.1`. - Private-network services. - Link-local cloud metadata endpoints. - Local files through schemes such as `file://`, where supported by the installed `curl`. - A permitted-looking public URL that redirects to an internal destination, because `curl -L` follows redirects without revalidating the target. The script also does not place the `--` end-of-options marker before the user-controlled argument. A value beginning with a hyphen may therefore be interpreted as a `curl` option rather than as a URL. The fetched response is analyzed and selected data is printed in the report, including the title, metadata, canonical URL, heading counts, and keyword statistics. This creates a limited disclosure channel for data obtained from local or internal resources. ### Attack Path 1. An attacker provides a URL pointing to a resource accessible from the Agent host, such as a loopback service, private-network application, or cloud metadata endpoint. 2. Alternatively, the attacker supplies a public URL that redirects to an internal or link-local address. 3. The Agent invokes `seo-analyze.sh` with the attacker-controlled URL as documented by the skill. 4. `curl` accesses the destination using the Agent ...[truncated 971 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs users to run shell commands (./seo-analyze.sh, curl | ./seo-analyze.sh) but does not declare any tool restrictions or permissions in the skill manifest. This creates ambiguity about what execution capabilities the skill expects and increases the risk of unsafe command use, especially because it processes attacker-controlled URLs and suggests piping remote content into a local script.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: At L011, the script automatically performs an HTTP request with curl to fetch the supplied URL. While this is central to the analyzer's function, the file provides no explicit warning that running it will contact remote hosts and transmit the requested URL and user-agent string over the network.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.