React Seo Skills

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:35 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent SEO helper for React, Next.js, Astro, and Vite projects, with ordinary dependency-change risks but no evidence of hidden malicious behavior.

Before installing, be comfortable with the skill reading your web app structure and helping modify SEO files, metadata, robots.txt, sitemaps, and possibly dependencies. Review any npm, pnpm, yarn, bun, or npx command before it runs, consider pinning package versions, and replace example domains, locales, social handles, and contact details with real project-approved values.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/astro.md:49

Finding

Unpinned Third-Party Dependency Installation and Execution

Content

View full analysis

Vulnerability Details

File Locations:

• references/astro.md:49-56
• references/pages-router.md:238-239
• references/react-helmet-async.md:15
• references/react-helmet-async.md:39-49

Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippets

references/astro.md:49-56:

bash

npx astro add sitemap

The equivalent manual installation is:

bash

npm install @astrojs/sitemap

references/pages-router.md:238-239:

bash

npm install next-sitemap

references/react-helmet-async.md:15:

text

Install the current compatible major: npm install react-helmet-async

references/react-helmet-async.md:39-49:

text

| Lockfile                   | Command                          |
| -------------------------- | -------------------------------- |
| pnpm-lock.yaml             | pnpm add react-helmet-async      |
| yarn.lock                  | yarn add react-helmet-async      |
| bun.lock / bun.lockb       | bun add react-helmet-async       |
| package-lock.json / none   | npm install react-helmet-async   |

bash

npm uninstall react-helmet && npm install react-helmet-async

Technical Analysis

These instructions direct an agent to resolve and install mutable package versions from a third-party package registry. No exact reviewed versions or integrity values are specified.

Package managers may execute lifecycle scripts during installation. Consequently, a compromised package release, maintainer account, registry response, or transitive dependency could cause arbitrary code to run with the permissions of the user invoking the agent.

The npx astro add sitemap command presents additional exposure because npx may retrieve and execute a package when an appropriate trusted local binary is unavailable. The effective code executed can therefore differ from the cod ...[truncated 1785 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every recommended dependency to an explicitly reviewed version, for example package@x.y.z, rather than resolving the current registry release.
2. Prefer versions already recorded in the project's lockfile and preserve the project's established package manager.
3. Require explicit developer confirmation before adding, removing, or upgrading any dependency.
4. Avoid npx behavior that downloads missing packages. Invoke a verified project-local binary or use a package-manager mode that refuses implicit remote installation.
5. Review package provenance, maintainers, release history, integrity metadata, and lifecycle scripts before installation.
6. In automated environments, use frozen-lockfile or immutable-installation modes so unresolved dependency changes fail rather than silently updating the dependency graph.
7. Run dependency installation in a restricted environment with minimal filesystem access, no unnecessary credentials, and no elevated privileges.
8. Where supported and operationally appropriate, disable lifecycle scripts during initial dependency retrieval and review any required scripts before enabling them.
9. Separate package removal and installation into reviewed steps rather than presenting a compound command that immediately modifies the dependency graph.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

SEO and AI-search visibility for Next.js, Astro, and React applications. Works in Cursor,
Claude Code, and Codex via native skill discovery.

<!-- BEGIN:react-seo-skills -->

> **This may NOT be the Next.js, React, Vite, or react-helmet-async you know.**
>

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 65% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/structured-data.md (reported line 78)May include surrounding context.

md

<script
        type="application/ld+json"
        // .replace() prevents </script> breakout from untrusted data
        dangerouslySetInnerHTML={{
          __html: JSON.stringify(jsonLd).replace(/</g, "\\u003c"),
        }}
      />

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 65% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/structured-data.md (reported line 106)May include surrounding context.

md

<script
        type="application/ld+json"
        // .replace() prevents </script> breakout from untrusted data
        dangerouslySetInnerHTML={{
          __html: JSON.stringify(jsonLd).replace(/</g, "\\u003c"),
        }}
      />

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description says to use the skill for a wide range of activities including "setting up metadata," "auditing SEO," and "improving discoverability," without defining boundaries or exclusion conditions. In a markdown skill description, this breadth makes activation scope ambiguous and increases the chance of unintended invocation for general web-development or content tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description states the skill "Matches JavaScript or TypeScript to the project language," and the rules later require detecting language before anything else. This imposes a language choice without user opt-in, which is a natural-language policy issue when the skill does not offer the user any alternative or override.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/astro.md (reported line 35)May include surrounding context.

md

Use the first clear signal:

| Signal                                                                                 | Stack | Reference |
| -------------------------------------------------------------------------------------- | ----- | --------- |
| `astro.config.mjs`, `astro.config.js`, `astro.config.ts`, or `astro` in `package.json` | Astro | This file |
| `src/pages/` containing `.astro`, `.md`, or `.mdx` pages                               | Astro | This file |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/react-vite.md (reported line 39)May include surrounding context.

md

When SEO is requested for a Vite or plain React app:

| Step | Action                                                                                            |
| ---- | ------------------------------------------------------------------------------------------------- |
| 1    | Detect package manager from lockfile                                                              |
| 2    | Choose native React metadata or `react-helmet-async` based on the React version and project needs |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/validation.md (reported line 4)May include surrounding context.

md

# Validation Tools

Run these after every SEO or GEO implementation. Never assume output is correct
without checking.

---

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The metadata example sets locale: "en_US", which prescribes a specific locale in natural-language-facing guidance. Because this is a general App Router reference rather than a region-specific skill, the file does not offer user opt-in or explain why US English is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The root layout example again specifies locale: "en_US" as default guidance. Repeating a fixed locale in a broadly applicable reference can push consumers toward a language/locale choice they did not request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The sample Astro layout sets <html lang="en">, which imposes a specific language/locale in natural-language content. This file does not present that as optional, configurable, or limited to an English-only project, so it can conflict with an organizational language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The text explicitly instructs authors to 'Write in plain language — this is read by AI models, not humans.' This imposes a language/style constraint in natural language without offering a user choice or clarifying that it is optional, which matches the policy category for language or locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction 'Match project language for any code output' imposes a language policy in natural language. Under the stated policy rules, forcing a specific language or locale without explicit user opt-in can be a policy violation, and this line does not mention offering the user a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction says all generated files, examples, and edits must match the project's language, which enforces a language choice based on project state rather than user opt-in. Under the policy, forcing a specific language or locale without offering a choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The section labeled "hreflang (Multilingual)" instructs adding alternate language links for English and French examples, which introduces locale-specific behavior in the guidance. Because the file does not explicitly state that language variants are optional or user-selected, it can be read as prescribing multilingual locale behavior without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The sample index.html sets <html lang="en">, which instructs the agent toward a fixed language/locale choice. The file does not indicate that English is optional, configurable, or required for a region-specific use case, so this can violate the language/locale policy for broadly applicable guidance.

Content

No source excerpt is available for this finding.