Local Geo Writer

• Outcome: Review
• Latest audit: Jul 24, 2026 · 1:04 AM UTC
• Version: 2.1.2

Overview

This skill is a commercial GEO article generator, but its documentation and runtime behavior do not line up, and it can send credentials and article inputs to an under-disclosed HTTP backend.

Review this carefully before installing. Do not put a real DeepSeek API key or confidential business/customer content into GEO_USER_KEY or prompts unless the publisher clarifies the backend, uses HTTPS, and documents what data is sent and retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares required binaries and environment variables but does not explicitly declare permissions despite clearly enabling network access, environment variable use, and file-writing workflows via the documented Python commands. This creates a transparency and governance gap: users may invoke a skill that transmits data to a third-party API and writes generated content locally without an explicit permission declaration or user-facing warning.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is presented as a GEO article generator, but it also provides account registration, account lookup, and service/pricing discovery against a remote paid backend. That capability expansion is security-relevant because it broadens what the skill can do and what data it can collect or transmit beyond the user's likely expectation, increasing the chance of undisclosed data sharing and misuse.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The generic 'services' command enumerates backend AI services and pricing that are unrelated to the stated GEO-writing purpose. This exposes an unnecessary discovery surface to users and may enable unintended access patterns or promote other backend capabilities without informed consent.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger conditions are broad and overlap with generic content marketing, SEO, and local business writing tasks, which increases the chance the skill will auto-activate in contexts where the user did not specifically request this tool. Over-broad activation becomes more risky here because the skill is commercial, requests credentials, and is designed to generate and potentially externalize user content through a third-party model API.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to set an API key for DeepSeek and optionally a custom API endpoint, but it does not clearly disclose that article prompts, business data, keywords, and possibly local content drafts will be sent to an external third-party model service. This can lead to inadvertent disclosure of sensitive commercial information, customer data, or unpublished marketing content without informed consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code automatically attaches the user credential from environment variables to outbound API requests without a meaningful disclosure of where it is sent or how it is used. Because the backend is a third-party service and the default URL is plaintext HTTP, this can expose account credentials to interception or unauthorized backend handling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: User-supplied article inputs are sent to a remote backend without a clear network/privacy warning, so users may unknowingly transmit sensitive business topics, drafts, or proprietary keywords off-device. In this skill's context, that is more dangerous because content generation often involves confidential marketing plans and client information.

External Transmission

Medium

• Category: Data Exfiltration

Content

if method == "GET":
            resp = requests.get(url, headers=h, params=data or {}, timeout=30)
        else:
            resp = requests.post(url, headers=h, json=data or {}, timeout=60)
        if resp.status_code >= 400:
            try:
                err = resp.json()

• Confidence: 93% confidence
• Finding: The skill transmits data to an external backend, including user content and potentially credentials, which creates a direct exfiltration path from the local environment to a third-party service. This is especially risky here because the configured default endpoint uses insecure HTTP to a public IP, making interception and tampering more feasible.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.