ClawHub
Back to skill

Security audit

Geo Content Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill provides disclosed content-publishing planning templates and small local helpers, without evidence of hidden access, credentials, persistence, or automatic publishing.

Installers should treat this as a planning and copy-generation skill, not an automated publishing connector. Review generated public-facing copy, schema, sitemap, llms.txt, and social recommendations before applying them to production channels.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared description promises a broad orchestration skill for GEO content publishing, distribution, multi-channel adaptation, and AI visibility. The supplied code only parses a local JSON file and renders a markdown table with columns like channel, role, format, message, CTA, and canonical target. It does not publish content, distribute to channels, transform content into variants, analyze optimization, or interface with any external systems. While a channel-plan table could be a supporting artifact within a larger publishing workflow, this code chunk by itself has a much narrower and materially different primary purpose than the declared skill.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description promises a broad, end-to-end system for publishing and distributing GEO-optimized content across many channels, including repurposing one core piece into multiple variants and improving visibility to AI crawlers/generative engines. The supplied code does not implement any of that orchestration or distribution behavior. It only builds a fixed markdown skeleton for a single longform page, parameterized by topic and brand, and prints or saves it. While the template language references GEO-friendly content, the actual functionality is limited to snippet generation. This is a materially narrower and different primary purpose than the declared skill description.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger criteria are intentionally broad, causing the skill to activate on many generic publishing requests even when not specifically needed. Over-broad activation increases attack surface for prompt injection and tool misuse because the model may route unrelated tasks into a workflow that encourages extensive content transformation, metadata generation, and operational guidance.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The instruction to trigger beyond exact keywords based on vague inferred intent makes activation ambiguous and hard to audit. In agentic systems, ambiguous routing can be abused by adversarial phrasing to invoke a powerful planning/orchestration prompt unexpectedly, increasing the chance of inappropriate actions or unsafe handling of user content.

Vague Triggers

Low
Confidence
89% confidence
Finding
The eval prompts use very broad, natural-language publishing requests that can match many ordinary content-authoring tasks without clearly constraining when the skill should activate. In a routing or agent-selection system, this can cause over-invocation of the skill, leading to unintended content-distribution actions, noisy behavior, or misuse of GEO/AI-crawler optimization guidance in contexts where the user did not explicitly request it.

Static analysis

No suspicious patterns detected.