Security audit

SEO + GEO Content Engine

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed SEO content-writing workflow with optional search and spreadsheet access, but its broad triggers may start the workflow unintentionally.

Install this if you want an SEO/GEO article-generation workflow. Prefer explicit prompts like "write article: <keyword>", and only provide a scoped SerpAPI key or read-only/public Google Sheet if you want live integrations; otherwise use pasted keywords or SERP exports.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Confidence: 96% confidence
Finding: Allowing activation from simply typing a keyword directly is overly permissive and creates a high risk of accidental or inappropriate invocation. In a chat environment, many ordinary user inputs could be mistaken for a trigger, causing the agent to launch a multi-step workflow with external access assumptions and content generation behavior the user did not explicitly request.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Broad trigger phrases like "write article," "generate blog post," or "create SEO content" are weakly scoped and may match benign conversation that is not intended to invoke this specific skill. This can lead to unintended execution of a complex pipeline, possibly causing confusing behavior, unnecessary external lookups, or generation of content the user did not consent to produce.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.