ClawHub
Back to skill

Security audit

AEO Keyword Selector

Security checks for vulnerabilities and agentic risk

Overview

This SEO keyword-selection skill is coherent and not malicious, though it relies on web/page fetching and includes a sitemap helper that should be used with scoped inputs.

Install this only if you want an agent to perform SEO keyword qualification using sitemap review, fetched page checks, and Semrush/browser validation. Run the sitemap parser only on trusted HTTPS sitemaps or known workspace XML files, keep any output path inside the workspace, and confirm important content-strategy decisions before handing them to a writing or publishing workflow.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read local reference files, parse sitemap content, and fetch website pages, but it declares no permissions. That creates a capability mismatch where a caller or reviewer cannot accurately assess that the skill performs file and network access, increasing the risk of unintended data exposure or ungoverned outbound requests.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The skill is presented as a keyword-selection workflow, but its operational behavior includes recursive sitemap parsing, local file reads, and remote fetching without clearly surfacing those behaviors as part of the contract. This mismatch is dangerous because it can hide data-accessing and network-reaching behavior behind a benign-seeming content strategy description, undermining trust, review, and least-privilege enforcement.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This script accepts an arbitrary local path as input and also allows writing output to an arbitrary file path, which expands the skill's filesystem access well beyond its stated keyword-selection purpose. In an agentic context, untrusted or model-generated arguments could be abused to read sensitive local XML files or overwrite files the process can access, making this a real security boundary issue even though the code appears utility-oriented rather than overtly malicious.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill enables implicit invocation for a keyword-selection capability without defining any trigger conditions or constraints, which can cause the agent to invoke it automatically in situations the user did not clearly intend. Because this skill influences planning and URL/page-targeting decisions, unintended invocation can alter content strategy, create unwanted actions in downstream workflows, or expose the system to prompt-manipulation through loosely scoped autonomous use.

Static analysis

No suspicious patterns detected.