GEO Visual Content Engine

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:20 AM UTC
• Version: 3.0.5

Overview

The skill is broadly aligned with e-commerce asset generation, but it has unsafe handling of store credentials, live publishing, and writable output paths that should be reviewed before installation.

Install only after reviewing the code paths that use Shopify and WooCommerce credentials. Use a test store first, avoid setting store admin credentials as ambient environment variables unless publishing is intended, use least-privilege tokens, validate store URLs, and constrain output paths to a dedicated directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: src/shopify.py:45

Finding

Shopify access token can be transmitted to an unvalidated host without publishing consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/woocommerce.py:50

Finding

WooCommerce credentials are used automatically without HTTPS or destination validation

Content

View full analysis

str: base = f"{self.store_url}/wp-json/{self.api_version}" return f"{base}/{endpoint.lstrip('/')}" ``` ```python try: response = requests.get( self._get_api_url("system_status"), auth=self.auth, timeout=10 ) ``` The authenticated connection test is initiated during automator construction: ```python self.woocommerce = WooCommerceIntegration( store_url=woo_store_url, consumer_key=woo_consumer_key, consumer_secret=woo_consumer_secret ) # Check connections self._check_connections() ``` ### Technical Analysis The integration accepts `WOOCOMMERCE_STORE_URL` without checking its scheme or origin. An HTTP URL is accepted, as is an arbitrary HTTPS host. The resulting endpoint is used with OAuth1 authentication. Although OAuth1 signs requests rather than necessarily transmitt ...[truncated 1930 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/main.py:562

Finding

Caller-controlled output path allows arbitrary file overwrite

Content

View full analysis

None: """Save result to JSON file""" output_file = Path(output_path) output_file.parent.mkdir(parents=True, exist_ok=True) with open(output_file, "w", encoding="utf-8") as f: json.dump(result, f, indent=2, ensure_ascii=False) ``` The output path is taken directly from runtime JSON: ```python output_path = input_data.get("output", "output/result.json") automator.save_result(result, output_path) ``` ### Technical Analysis The code accepts an arbitrary path from JSON input and passes it directly to `Path` and `open(..., "w")`. It does not reject absolute paths, normalize and confine relative paths, prevent `..` traversal, check for symbolic links, or require explicit confirmation before replacing an existing file. Although `schemas/input_schema.json` declares `additionalProperties: false` and does not define an `output` property, the runtime does not validate input against that schema. The undeclared `output` field is therefore accepted. Opening the path with mode `"w"` truncates an existing file. `mkdir(parents=True)` also permits creation of attacker-selected directory trees wherever the process has permission. ### Attack Path 1. An attacker supplies workflow JSON containing an `output` property. 2. The property contains an absolute path or traversal sequence, such as `../../target.json`. 3. The runtime accepts the property because no schema validation is performed. 4. The workflow completes and calls `save_result()`. 5. Parent directories are created if possible. 6. The selected target is opened in write mode and truncated. 7. Generated JSON replaces the previous file contents. Exploitation is limited to paths writa ...[truncated 793 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/product_synthesizer.py:193

Finding

Unsanitized product input is published as storefront HTML

Content

View full analysis

About This Product

Introducing our premium {product_name}, designed to exceed your expectations. Crafted with precision and attention to detail, this product offers exceptional value and performance.

Key Features

• Premium quality materials
• Durable and long-lasting
• Modern design
• Easy to use
• Great value for money

Why Choose {product_name}?

Our {product_name} stands out from the competition with its superior build quality and thoughtful design. Whether you're a beginner or professional, this product is perfect for your needs.

Order now and experience the difference!

""" ``` The fallback-language branch has the same issue: ```python description = f"""

{product_name}

Premium quality product with excellent features and great value.

Features:

• High quality materials
• Durable construction
• Modern design
• Easy to use

Order now!

""" ``` Shopify receives the unsanitized HTML: ```python product_data = { "product": { "title": title, "body_html": description, ``` WooCommerce also receives it directly: ```python product_data = { "name": title, "description": description, "short_description": short_description, ``` ### Technical Analysis `product_name` and caller-provided descriptions are treated as trusted HTML. The synthesizer inserts `product_name` into HTML templates without escaping special characters. In addition, when a caller supplies `description`, `synthesize()` uses ...[truncated 1787 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:6

Finding

Unpinned and unnecessary dependencies create supply-chain exposure

Content

View full analysis

=0.1.0 # Legacy package (for compatibility) google-generativeai>=0.8.0 # HTTP requests requests>=2.31.0 # Image processing (required for saving generated images) pillow>=10.0.0 # Optional: for async operations aiohttp>=3.9.0 ``` ### Technical Analysis The dependency file does not pin exact versions or provide package hashes. A clean installation may therefore select future package releases that were not reviewed with the Skill. This makes builds non-reproducible and increases exposure to compromised upstream releases, unexpected breaking changes, and newly introduced vulnerabilities. The audited source imports `google.genai`, `requests`, and Pillow. The listed legacy `google-generativeai` package and optional `aiohttp` package are not used by the inspected runtime code, unnecessarily expanding the dependency and transitive-dependency surface. No evidence was found that the currently named packages are typosquatted or intentionally malicious. The finding concerns unsafe dependency management rather than a confirmed malicious package. ### Attack Path 1. A user follows the installation instructions and runs `pip install -r requirements.txt`. 2. The package resolver selects the newest releases satisfying each lower-bound constraint. 3. A selected direct or transitive dependency may differ from the versions originally tested. 4. Package installation hooks or imported runtime code execute with the user's privileges. 5. A compromised or vulnerable future release can affect the Skill without any change to the audited repository. ### Impact Assessment Dependency in ...[truncated 557 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (65)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is framed as content generation, yet it reportedly performs direct WooCommerce or WordPress API access and live store mutation. That discrepancy materially increases risk because users may authorize a content tool without realizing it can publish products or change stock in a production commerce system.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is framed as content generation, yet it reportedly performs direct WooCommerce or WordPress API access and live store mutation. That discrepancy materially increases risk because users may authorize a content tool without realizing it can publish products or change stock in a production commerce system.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is framed as content generation, yet it reportedly performs direct WooCommerce or WordPress API access and live store mutation. That discrepancy materially increases risk because users may authorize a content tool without realizing it can publish products or change stock in a production commerce system.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is framed as content generation, yet it reportedly performs direct WooCommerce or WordPress API access and live store mutation. That discrepancy materially increases risk because users may authorize a content tool without realizing it can publish products or change stock in a production commerce system.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is framed as content generation, yet it reportedly performs direct WooCommerce or WordPress API access and live store mutation. That discrepancy materially increases risk because users may authorize a content tool without realizing it can publish products or change stock in a production commerce system.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is framed as content generation, yet it reportedly performs direct WooCommerce or WordPress API access and live store mutation. That discrepancy materially increases risk because users may authorize a content tool without realizing it can publish products or change stock in a production commerce system.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill requests and documents use of multiple high-privilege credentials, including store access tokens and API secrets, for networked operations against live commerce platforms. In this context, broad credential access is dangerous because compromise, misuse, or accidental invocation could lead to unauthorized publication, inventory changes, store reconnaissance, or leakage of business-sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

- `GOOGLE_API_KEY` - Google API Key for Nano Banana 2 image generation
- `SHOPIFY_STORE_URL` - Shopify store URL
- `SHOPIFY_ACCESS_TOKEN` - Shopify Admin API access token
- `WOOCOMMERCE_STORE_URL` - WooCommerce store URL
- `WOOCOMMERCE_CONSUMER_KEY` - WooCommerce API consumer key
- `WOOCOMMERCE_CONSUMER_SECRET` - WooCommerce API consumer secret

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/analyzer.py (reported line 182)May include surrounding context.

python

}
            })

        return prompts

    def _generate_content_drafts(
        self,

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/main.py (reported line 504)May include surrounding context.

python

}
            })

        return prompts

    def _generate_content_drafts(
        self,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/main.py (reported line 52)May include surrounding context.

python

Args:
            google_api_key: Google API Key for Nano Banana 2
            shopify_store_url: Shopify store URL
            shopify_access_token: Shopify Admin API access token
            woo_store_url: WooCommerce store URL
            woo_consumer_key: WooCommerce API consumer key
            woo_consumer_secret: WooCommerce API consumer secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/main.py (reported line 671)May include surrounding context.

python

Args:
            google_api_key: Google API Key for Nano Banana 2
            shopify_store_url: Shopify store URL
            shopify_access_token: Shopify Admin API access token
            woo_store_url: WooCommerce store URL
            woo_consumer_key: WooCommerce API consumer key
            woo_consumer_secret: WooCommerce API consumer secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/shopify.py (reported line 388)May include surrounding context.

python

Args:
            google_api_key: Google API Key for Nano Banana 2
            shopify_store_url: Shopify store URL
            shopify_access_token: Shopify Admin API access token
            woo_store_url: WooCommerce store URL
            woo_consumer_key: WooCommerce API consumer key
            woo_consumer_secret: WooCommerce API consumer secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/main.py (reported line 677)May include surrounding context.

python

args = parser.parse_args()

    # Get API keys from environment if not provided
    google_api_key = args.api_key or os.environ.get("GOOGLE_API_KEY")
    shopify_url = args.shopify_url or os.environ.get("SHOPIFY_STORE_URL")
    shopify_token = args.shopify_token or os.environ.get("SHOPIFY_ACCESS_TOKEN")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The code is designed to access a Shopify Admin API token, which is a powerful credential for store management. Credential access is especially sensitive here because the skill description does not clearly prepare the user for privileged store operations, increasing the likelihood of misuse or overbroad deployment.

Content

Scanner excerpt · src/shopify.py (reported line 43)May include surrounding context.

python

Args:
            store_url: Shopify store URL (e.g., "mystore.myshopify.com")
            access_token: Shopify Admin API access token
        """
        self.store_url = store_url or os.environ.get("SHOPIFY_STORE_URL", "")
        self.access_token = access_token or os.environ.get("SHOPIFY_ACCESS_TOKEN", "")

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code performs authenticated product creation in a live Shopify store, which materially exceeds the declared skill scope of generating visuals, product data, copy, and export-ready assets. In a skill context, undocumented write access to an external commerce platform is dangerous because it can alter production catalog state, publish unintended products, and create business impact without clear user expectation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill performs direct state-changing actions against a live WooCommerce store, including product creation and inventory updates, despite being framed as a content-generation and commerce-asset preparation tool. That mismatch is dangerous because users may authorize or invoke the skill expecting draft/export behavior, while the code can publish products and alter stock in production.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares access to sensitive environment variables and clearly describes networked publishing behavior, but it does not declare any explicit tool scope or allowed-tools policy. That creates an authorization gap where an agent may use broader capabilities than a reviewer or user expects, especially given the presence of store credentials and write-capable commerce workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The quick-start example hard-codes country="us" and language="en", which presents a default locale choice rather than asking the user to select one. Similar locale defaults recur in the documented API, and the file does not clearly state that users should be offered a language/locale choice first.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The API reference explicitly defines country='us' and language='en' as defaults for the main workflow. This is a natural-language policy concern because it bakes in a specific locale and language without indicating user consent, choice, or a justified regional limitation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a skill focused on generating visuals, structured product data, localized commerce copy, and export-ready commerce assets. This JSON additionally produces a multi-week social/media distribution strategy with channels, KPIs, timing guidance, and iteration planning, which is a broader marketing campaign planning function rather than a direct commerce asset generation detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON output includes a locale-setting field of "language": "en", which indicates the skill is forcing English output. The policy allows locale constraints only when the user is given a choice or when the restriction is clearly documented and justified, neither of which is present in this file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The prompt instructs the system to produce a generated_images field as if actual image generation and file persistence will occur, which implicitly expands the skill from content generation into side-effecting execution. This is dangerous because downstream orchestrators may treat the prompt as authorization to invoke tools or write files without explicit manifest declaration, user consent, or policy checks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The prompt explicitly states that the system will call Google AI Studio API, save generated images to local storage, and return file paths/URLs, introducing undeclared network access and local file writes. This creates a capability mismatch where an LLM prompt can socially engineer the host agent into performing sensitive side effects beyond the stated skill scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic image generation and local storage are presented as silent default behavior with no user-facing warning or consent step. Hidden side effects are risky because users may provide inputs assuming text-only processing, while the system performs external API calls, incurs cost, transmits data off-box, or writes artifacts locally without transparency.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The schema description explicitly promises an end-to-end workflow including auto-publishing, while the skill metadata describes generation of visuals, product data, copy, and export-ready assets. This mismatch can cause downstream systems or users to authorize a capability they did not reasonably expect, increasing the risk of unintended store modifications or product publication without clear consent boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.