Ollama SEO Auditor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:15 PM UTC
• Version: 1.0.0

Overview

This SEO audit skill is mostly purpose-aligned, but it gives the agent broad URL-fetching and command-use instructions without enough scoping or privacy boundaries.

Install only if you are comfortable with the agent fetching target pages and sending page content into a local Ollama analysis flow. Use it for public sites, avoid internal/private URLs unless you explicitly intend that audit, and review outputs carefully because webpage text could influence the generated SEO report.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:1
• Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery## Vulnerability Details **File Location**: `SKILL.md`, line 1 **Vulnerability Type**: Server-Side Request Forgery through unrestricted URL fetching **Risk Level**: High ### Vulnerable Code ```markdown ## Quick Audit 1. web_fetch url pt content. 2. Prompt Ollama (llama3:8b): "Analyze SEO: keywords, meta, headings, img alt, speed est. from HTML. Score 1-10. Fixes." 3. browser/screenshot pt visual (opțional). 4. Report Markdown + score. ``` ### Technical Analysis The skill directs the agent to pass an audit target directly to `web_fetch` without defining any destination validation or network-access restrictions. There are no controls requiring HTTP or HTTPS, resolving and validating the destination IP address, rejecting private or reserved address ranges, or revalidating redirect destinations. Because an SEO audit only requires access to public websites, allowing requests to arbitrary network locations violates the principle of least privilege. Depending on the protections implemented by the underlying tool, an attacker could supply a loopback, private-network, link-local, or cloud metadata URL. DNS rebinding and redirects may also bypass validation if checks occur only before resolution or on the initial URL. ### Attack Path 1. An attacker asks the agent to perform an SEO audit of a specially selected URL. 2. The URL points directly to an internal service, or redirects to a loopback, private, link-local, or cloud metadata address. 3. Following the skill instructions, the agent invokes `web_fetch` for that URL. 4. The fetch tool sends the request from its privileged network environment. 5. Any returned internal content enters the model context for SEO analysis. 6. The generated report may disclose retrieved content to the requester. ### Impact Assessment Successful exploitation could allow access to HTTP services reachable from the agent environment but unavailable to the external requester. The precise scope depends on the fetch tool's network permission ...[truncated 407 chars]
• Remediation: ## Remediation Suggestions 1. Accept only absolute `http://` and `https://` URLs. 2. Resolve every hostname and reject all loopback, private, link-local, multicast, unspecified, reserved, and documentation address ranges for both IPv4 and IPv6. 3. Explicitly block cloud metadata endpoints, including link-local metadata addresses and provider-specific metadata hostnames. 4. Repeat DNS and IP validation for every connection and redirect destination; do not validate only the original URL. 5. Limit redirect counts and reject redirects to a different trust zone. 6. Prefer an explicit allowlist of public domains when the operational context permits it. 7. Disable forwarding of ambient credentials, cookies, authorization headers, and client certificates. 8. Apply response-size limits, connection and read timeouts, and content-type restrictions. 9. Run the fetcher in an isolated environment with no access to internal networks or metadata services. 10. Require explicit user confirmation and separate authorization for any legitimate private-network audit.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:1
• Finding: Untrusted Webpage Content Is Passed Directly to an LLM Without Prompt-Injection Isolation## Vulnerability Details **File Location**: `SKILL.md`, line 1 **Vulnerability Type**: Indirect prompt injection through attacker-controlled HTML **Risk Level**: Medium ### Vulnerable Code ```markdown ## Quick Audit 1. web_fetch url pt content. 2. Prompt Ollama (llama3:8b): "Analyze SEO: keywords, meta, headings, img alt, speed est. from HTML. Score 1-10. Fixes." 3. browser/screenshot pt visual (opțional). 4. Report Markdown + score. ``` ### Technical Analysis The workflow fetches remotely controlled webpage content and then supplies that content to an LLM for analysis. It does not instruct the model to treat the HTML strictly as untrusted data, ignore instructions embedded in the page, or constrain its output to a validated SEO schema. A malicious page can place natural-language instructions in visible text, metadata, accessibility attributes, comments, structured data, or other HTML fields likely to be included in the model input. The model may interpret those instructions as part of its task rather than as content under analysis. This is an indirect prompt-injection boundary failure. The available project files do not show autonomous execution of model-generated commands. Therefore, the confirmed scope is manipulation of the SEO analysis and generated report; broader tool use would depend on capabilities supplied by the surrounding agent runtime. ### Attack Path 1. An attacker publishes a webpage containing instructions crafted for an LLM, such as directions to ignore the SEO task, assign a false score, or emit attacker-selected text. 2. A user requests an SEO audit of that page. 3. The skill fetches the page content with `web_fetch`. 4. The fetched HTML is included in the prompt sent to Ollama without an explicit trust boundary or instruction-isolation mechanism. 5. The model interprets the embedded page text as instructions. 6. The resulting SEO report is falsified, redirected, or populated with attacker-controlled claims. ### Impact Assessment An ...[truncated 542 chars]
• Remediation: ## Remediation Suggestions 1. Add an explicit instruction that fetched HTML is untrusted data and that no instructions, requests, policies, or tool directives contained within it may be followed. 2. Place page content inside clearly marked data delimiters that cannot be confused with system or task instructions. 3. Avoid sending full raw HTML when possible. Parse the page deterministically and provide only required fields such as the title, meta description, headings, canonical URL, structured-data summary, image alternative text, and measured performance data. 4. Keep the analysis model tool-free and prevent model output from being interpreted as commands. 5. Require output that conforms to a strict SEO-report schema, then validate field types, allowed ranges, and lengths. 6. Treat generated URLs, commands, and procedural instructions as untrusted output requiring separate validation and user approval. 7. Apply input-size limits and remove scripts, comments, hidden elements, and unrelated text before model processing where those elements are not needed for the audit. 8. Add regression tests containing prompt-injection strings in metadata, comments, headings, image attributes, and structured data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases and description are broad enough to activate on common requests like site performance checks or web page analysis, which can cause the skill to run outside a narrowly intended SEO-audit context. Over-broad activation increases the chance of unintended tool use, including fetching arbitrary URLs and invoking local command execution, which expands attack surface and can lead to privacy or safety issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs use of web_fetch, browser, web_search, and exec with an Ollama prompt over page content, but it does not disclose that target URLs, retrieved HTML, screenshots, or derived content may be sent to tools and models during processing. This creates a transparency and data-handling risk, especially if users provide internal, private, or sensitive URLs under the assumption that the audit is self-contained and harmless.