GEO Site Readiness Audit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:18 AM UTC
• Version: 1.0.1

Overview

The skill is a legitimate website audit tool, but it can make unvalidated requests to any user-supplied host, including internal network targets, so it should be reviewed before installation.

Install only if you are comfortable with the skill making outbound HTTP requests. Use it for domains you own or are authorized to test, avoid internal IPs or localhost targets, and run it in an environment with egress controls. Review the CI examples before copying them, especially quoting user-controlled variables.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/geo_audit.py:24

Finding

Unrestricted Server-Side Request Forgery Through User-Controlled Audit Targets

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/integrations.md:15

Finding

Shell Command Injection in GitHub Actions Integration Example

Content

View full analysis

audit.json ``` ### Technical Analysis GitHub Actions evaluates `${{ ... }}` expressions before passing the resulting script to the command shell. The `SITE_URL` value is interpolated directly into shell source code without quoting. If an attacker can control or influence this variable, shell metacharacters, command substitutions, redirections, or command separators in the value will be interpreted by the runner shell rather than treated only as a URL argument. This is distinct from ordinary argument injection: direct expression interpolation changes the shell program itself before execution. ### Attack Path 1. A workflow adopts the documented GitHub Actions integration. 2. An attacker gains the ability to define or influence `vars.SITE_URL`, such as through an insufficiently protected repository or environment variable. 3. The attacker places shell syntax in the variable value. 4. GitHub Actions substitutes the value into the `run` script before shell execution. 5. The runner shell interprets the injected syntax and executes attacker-selected commands with the workflow job's permissions. ### Impact Assessment Successful exploitation provides command execution in the GitHub Actions runner. The resulting scope depends on workflow permissions and secret availability, but may include: - Reading files and generated artifacts in the runner workspace. - Modifying audit output or build artifacts. - Accessing environment variables available to the job. - Using the workflow's repository token within its configured permissions. - Exfiltrating secrets exposed to the affected workflow. - Modifying repository contents if the workflow token has write privileges. Exploitatio ...[truncated 112 chars]

Remediation

View remediation

audit.json ``` Additionally: 1. Validate `SITE_URL` as a public HTTP or HTTPS URL before using it. 2. Restrict who can modify repository and environment variables. 3. Use protected GitHub environments for security-sensitive configuration. 4. Apply least-privilege `permissions` settings to the workflow token. 5. Do not expose sensitive secrets to workflows that process attacker-influenced configuration. 6. Prefer argument-array execution in programmatic integrations where no shell is needed. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/geo_audit.py:10

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Remediation

View remediation

``` 2. Generate and commit a lock file containing exact transitive dependency versions. 3. Use hash-verified installation, such as `pip install --require-hashes -r requirements.txt`. 4. Configure automation to use an approved package index or internal mirror. 5. Run dependency vulnerability and provenance checks in CI. 6. Document supported Python and dependency versions. 7. Replace the runtime installation suggestion with a command referencing the project's locked dependency file. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation advertises executable scripts that perform network access and write output files, but it declares no explicit tool scope or permissions. In an agent environment, this can lead to overbroad execution where the skill is invoked with more capability than users or reviewers expect, increasing the chance of unintended external requests or local file modifications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description contains broad trigger phrases like 'use whenever the user mentions' several related topics, which can cause the skill to activate in contexts that do not require it. Over-triggering is risky because this skill performs website auditing actions, potentially causing unsolicited network access, scans of third-party domains, or report generation based on ambiguous user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring says this function checks whether core content is present in raw HTML, implying it analyzes the fetched response body. However, the code uses html.lower() even though no html variable exists, so it cannot perform the documented check and will fail at runtime rather than auditing page content.

Content

No source excerpt is available for this finding.

Dynamic Request Target

Medium

• Category: Server-Side Request Forgery
• Confidence: 95% confidence

Finding

The script performs HTTP requests to a fully user-controlled target (self.domain) without validation, allowing the runtime environment to be used as a network proxy to reach arbitrary hosts. In an agent or server context, an attacker could target internal IPs, localhost, cloud metadata endpoints, or other restricted services, turning a GEO audit into an SSRF primitive.

Content

Scanner excerpt · scripts/geo_audit.py (reported line 371)May include surrounding context.

python

def check_https(self):
        """Check 4.2: HTTPS enforced."""
        try:
            http_resp = requests.get(f"http://{self.domain}", timeout=self.timeout, allow_redirects=False)
            if http_resp.status_code in [301, 302] and 'https' in http_resp.headers.get('Location', ''):
                return {"check": "HTTPS enforced", "status": "pass", "notes": "HTTP redirects to HTTPS"}
        except:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code performs HTTP requests to the target domain provided by the user, which is a network operation covered by the missing-warning rule for code files. Although the script's purpose is auditing websites, the code itself provides no confirmation prompt or user-facing disclosure at the point of access about contacting external systems and transmitting headers such as the User-Agent.

Content

No source excerpt is available for this finding.