ClawHub
Back to skill

Security audit

GEO Content Studio

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed GEO workflow router that drafts or coordinates content deliverables without hidden persistence, credential access, network retrieval, or destructive behavior.

Install only if you want a GEO content orchestration entry point. Treat generated articles, JSON-LD, and llms.txt output as drafts, and review any downstream subskills' permissions before letting them edit site files or publish content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill description is written as a default entry point for nearly any GEO-related request, which makes activation boundaries too broad. In a multi-skill environment, this can cause the orchestrator to intercept generic user requests and route them into downstream content-creation or file-modifying workflows without the user explicitly selecting this skill.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The intent-recognition signals rely on very common verbs like 'create', 'write', 'fix', 'report', and 'optimize', which overlap heavily with ordinary user language. This increases the chance of accidental triggering and unintended routing to specialized subskills, especially if those subskills generate content or alter user-managed assets.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The available-skills section advertises creation and update capabilities such as generating content, schema, and llms.txt, but it does not clearly warn users that workflows may create or modify publishable assets. This can mislead users about the operational effects of invoking the skill and reduce informed consent for downstream actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Every content path ends with human editing. Non-negotiable.

**Rule 2: Skip research if topic is known**
If you say "write a 'What is GEO?' article", skip prompt research.

**Rule 3: Don't run full audit for single requests**
If you just need FAQ schema, go directly to schema generation.
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest describes a master orchestrator that understands user goals, automatically selects workflows, and serves as the default starting point for a wide range of GEO-related tasks. In practice, this file maps a small set of predefined intents to hard-coded skill lists, and the `topic` parameter is unused, so there is no evidence here of intelligent interpretation or dynamic routing based on user goals.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The description says this should be the default starting point for creating GEO content, ranking in AI search, auditing AI visibility, building strategies, writing AI-citable articles, or use when unsure which skill to use. The command-line interface restricts input to five fixed intent values and requires the caller to preclassify the task, which is materially narrower than the advertised role.

Vague Triggers

Low
Confidence
83% confidence
Finding
The 'broad request' opening question does not define clear limits for when the studio should activate, so the skill may engage on vague prompts without first establishing that the user actually wants GEO orchestration. While lower severity than the broad description itself, it still contributes to ambiguous activation and overreach.

Static analysis

No suspicious patterns detected.