Local Geo Writer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 2.1.2

Overview

Review before installing: the skill is an article generator, but its docs and code disagree about credentials and the code can send keys and article inputs to an undocumented plaintext HTTP service.

Do not install this version unless you are comfortable sending article topics and account credentials to the publisher's backend. Do not put a DeepSeek API key in GEO_USER_KEY for this skill; if you already followed those instructions, revoke and rotate that key. The publisher should align the docs with the actual commands, identify the service operator and data handling, require HTTPS only, and declare/pin the runtime dependency.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/geo_writer.py:17

Finding

Authentication credentials and business data are transmitted over plaintext HTTP

Content

View full analysis

Remediation

View remediation

other

Error

• Location: SKILL.md:75

Finding

Documentation can cause users to disclose a DeepSeek API key to an unrelated proprietary service

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/geo_writer.py:12

Finding

Undeclared and unpinned third-party runtime dependency creates supply-chain exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill declares executable requirements and documents behavior that implies environment access, file output, and outbound network use, but it does not declare any explicit tool scope or permission boundaries. That makes the skill harder to sandbox and review, increasing the chance that secrets, generated content, or other local data are accessed or transmitted without clear user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs users to set a sensitive API key and use it with a third-party model endpoint, but it does not clearly warn that prompts and business content may be transmitted off-host to an external provider. This creates a realistic risk of unintended secret exposure or privacy violations, especially if users generate articles from internal marketing plans, customer data, or regulated business information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The skill is explicitly configured to communicate with an external API endpoint, which means prompts, article content, and possibly sensitive business context can leave the local environment. In this skill's context, external transmission is expected for LLM-backed generation, but it is still security-relevant because users may unknowingly send confidential data to a third party.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

export GEO_USER_KEY="你的DeepSeek API Key"
# 可选：自定义API地址
export DEEPSEEK_BASE_URL="https://api.deepseek.com/v1"

第二步：生成文章

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description and user-facing interface strings are fixed in Chinese, which imposes a language choice on users without offering an alternative or opt-in. This matches the policy concern for language/locale constraints that are not explicitly optional or justified as region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The code performs external network transmission to a hard-coded remote API endpoint, including user content and potentially the X-User-Key credential. External transmission is expected for a SaaS-backed tool, but it remains security-relevant here because the default endpoint uses plain HTTP, allowing interception or manipulation in transit.

Content

Scanner excerpt · scripts/geo_writer.py (reported line 38)May include surrounding context.

python

if method == "GET":
            resp = requests.get(url, headers=h, params=data or {}, timeout=30)
        else:
            resp = requests.post(url, headers=h, json=data or {}, timeout=60)
        if resp.status_code >= 400:
            try:
                err = resp.json()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a GEO article generator but also implements account registration, account inspection, pricing discovery, and service enumeration against a remote SaaS backend. This expands the trust boundary and exposes users to unexpected account and commercial interactions that are not necessary for a narrowly scoped content-generation skill, increasing privacy and misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generate command transmits user-supplied keyword/industry/type data and an account key to a remote third-party API, but the tool gives no explicit privacy, retention, or transmission warning before doing so. In this context, users may reasonably assume a local writing helper, making undisclosed off-host data transfer more sensitive.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The services command enumerates backend AI services and pricing unrelated to the advertised GEO writing purpose, which can expose internal platform capabilities and encourage off-scope use. Even if intended as marketing, capability discovery broadens the attack surface and may leak operational metadata to any user of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill's natural-language instructions and user-facing guidance are entirely in Chinese, and the document does not indicate that the language requirement is optional or limited to a specific region. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The registration flow sends a username to a remote backend without an explicit disclosure that account data is being transmitted to an external service. While the data volume is small, it still creates an external account relationship and may surprise users who only expected local CLI behavior.

Content

No source excerpt is available for this finding.