T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.py:79- Finding
DataForSEO Password Is Collected Through Echoed Terminal Input
- Content
View full analysis
- Remediation
View remediation
Security audit
SEO AGI (Multi-Agent SEO: Research → Gap Analysis → Write → Validate → Ship)
Security checks for vulnerabilities and agentic risk
Overview
This SEO skill mostly does what it says, but its setup handles API credentials and Python installation in risky ways that should be reviewed before use.
Review before installing. Use a virtual environment instead of running setup.py against your system Python, do not use the README command that prints ~/.config/seo-agi/.env, avoid entering passwords in a shared or recorded terminal, and protect or replace the plaintext .env file with environment variables or a credential manager where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.py:102- Finding
Credential File Is Written Without Enforced Restrictive Permissions and Documentation Prints Its Contents
- Content
View full analysis
/dev/null || echo "No .env file -- skill will use fallback mode" ``` ### Technical Analysis The setup script stores DataForSEO credentials and future integration keys in plaintext. It opens the file without explicitly enforcing mode `0600`, so the resulting permissions depend on the process umask and any pre-existing file permissions. The documented `cat` command exposes every configured value to standard output. In an AI-agent environment, standard output can enter model context, execution transcripts, centralized logs, or caller-visible API responses. The command checks more than configuration status and unnecessarily reveals the complete secrets. Reading a dedicated `~/.config/seo-agi/.env` file is consistent with the skill's functionality, but unrestricted file creation and full-content ...[truncated 1169 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.py:41- Finding
Setup Installs Unpinned Dependencies Into the Active Python Environment
- Content
View full analysis
=2.28.0 ``` ### Technical Analysis The setup script invokes pip at runtime against the currently active Python interpreter. Its first installation attempt uses `--break-system-packages`, bypassing protections intended to prevent pip from modifying an externally managed Python environment. The package is not pinned to an exact version, and no package hashes are verified. Resolution can therefore select future versions of `requests` and its transitive dependencies. Package installation can execute build-system code, so a compromised distribution or dependency could execute with the privileges of the user running setup. Suppressing both standard output and standard error also limits the user's ability to review package sources, version selection, warnings, and installation failures. The use of the legitimate `requests` package is not dependency confusion by itself, but the installation strategy creates avoidable supply-chain and environment-integrity exposu ...[truncated 1254 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (57)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 77% confidence
- Finding
The troubleshooting step recommends
cat ~/.config/seo-agi/.env, which would print stored API credentials directly to the terminal or agent output. In an agent environment, that can expose secrets to logs, transcripts, screenshots, or downstream model context, turning a benign check into credential disclosure.- Content
Check if API keys are configured:
bash cat ~/.config/seo-agi/.env 2>/dev/null || echo "No .env file -- skill will use fallback mode"Test with live DataForSEO (if you have keys):
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description suggests straightforward content generation, yet the instructions include dependency installation, filesystem setup, credential collection, and configuration for third-party research services. These actions materially change the risk profile because they encourage environment modification and secret handling not implied by the public description.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The spec calls for API credentials to be stored in ~/.config/seo-agi/.env, which implies plaintext secret storage on disk. If file permissions are weak, the home directory is backed up/synced, or another local process/user can read the file, DataForSEO and GSC credentials could be stolen and abused for account access, data extraction, or billing-impacting API use.
- Content
text ~/.config/seo-agi/ ├── .env # API credentials ├── config.json # User preferences (default location, language, site URL) └── sites.json # GSC verified sites cache
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md """ seo-agi environment and configuration loader. Reads API keys from ~/.config/seo-agi/.env or os.environ. Resolves paths relative to the skill installation directory. """
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ seo-agi environment and configuration loader. Reads API keys from ~/.config/seo-agi/.env or os.environ. Resolves paths relative to the skill installation directory. """
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ seo-agi environment and configuration loader. Reads API keys from ~/.config/seo-agi/.env or os.environ. Resolves paths relative to the skill installation directory. """
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from pathlib import Path CONFIG_DIR = Path.home() / ".config" / "seo-agi" ENV_FILE = CONFIG_DIR / ".env" CONFIG_FILE = CONFIG_DIR / "config.json" OUTPUT_DIR = Path.home() / "Documents" / "SEO-AGI"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from pathlib import Path CONFIG_DIR = Path.home() / ".config" / "seo-agi" ENV_FILE = CONFIG_DIR / ".env" CONFIG_FILE = CONFIG_DIR / "config.json" OUTPUT_DIR = Path.home() / "Documents" / "SEO-AGI"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from pathlib import Path CONFIG_DIR = Path.home() / ".config" / "seo-agi" ENV_FILE = CONFIG_DIR / ".env" CONFIG_FILE = CONFIG_DIR / "config.json" OUTPUT_DIR = Path.home() / "Documents" / "SEO-AGI"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from pathlib import Path CONFIG_DIR = Path.home() / ".config" / "seo-agi" ENV_FILE = CONFIG_DIR / ".env" CONFIG_FILE = CONFIG_DIR / "config.json" OUTPUT_DIR = Path.home() / "Documents" / "SEO-AGI"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This finding corresponds to the code path that persists credentials into a .env file, creating a local credential exposure risk. In the context of an SEO skill, collecting third-party API secrets may be legitimate, but storing them unencrypted and without explicit warning makes compromise more likely if the workstation or home directory is accessed.
- Content
python else: gsc_path = input("Path to GSC service account JSON (or Enter to skip): ").strip() # Write .env env_lines = [ "# SEO-AGI Configuration", f"# Generated by setup.py on {__import__('datetime').datetime.now().isoformat()[:10]}",
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Step 3: Configure API keys (optional but recommended)
bash mkdir -p ~/.config/seo-agi cp ~/.claude/skills/seo-agi/.env.example ~/.config/seo-agi/.env
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README states the skill auto-triggers on broad SEO content requests, which can cause unintended invocation on generic prompts and lead an agent to perform networked research, content generation, and file-writing actions the user did not explicitly authorize. In an agent environment, overbroad trigger scope increases the chance of surprise side effects and tool execution beyond user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README says the skill will save generated pages to
~/Documents/SEO-AGI/pages/but does not warn about file creation, naming, or overwrite behavior. In agentic contexts this can result in silent local writes, clobbering existing content, or leaving sensitive/generated material on disk without informed consent.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Check if the skill is installed:
bash ls ~/.claude/skills/seo-agi/SKILL.md && echo "Installed" || echo "Not found"Check if API keys are configured:
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Check if the skill is installed:
bash ls ~/.claude/skills/seo-agi/SKILL.md && echo "Installed" || echo "Not found"Check if API keys are configured:
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. Find what's ranking 2. Figure out what they cover that you don't 3. Write something deeper 4. Add the technical SEO (schema, meta, structure) 5. Publish and move on
Static analysis
No suspicious patterns detected.