Security audit

Geo Content Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed GEO content planning helper that produces publishing plans and markdown templates, with no evidence of hidden execution, credential use, remote fetching, or direct account mutation.

Install this only if you want a planning-oriented GEO publishing workflow. Review its broad trigger wording if your environment has many content skills, and be careful when using the helper scripts' --output option because it writes to the path you provide.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad, end-to-end system for GEO content publishing, distribution, repurposing content across channels, and improving AI search visibility. The supplied code does not perform any of those operational tasks. It only parses a local JSON file containing channel metadata and renders that data into a markdown table. This is at most a planning/documentation helper for channel definitions, not an orchestrator for publishing or distributing content. Therefore the actual behavior is materially narrower and different from the declared primary purpose.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad, end-to-end GEO content publishing and distribution system covering multiple channels such as blogs, docs, landing pages, social, newsletters, and app updates, with orchestration and AI visibility goals. The supplied code does not implement those capabilities. It only builds a markdown skeleton for one longform page with predefined sections like Summary, FAQ, and use cases, then prints or saves that snippet. While the template is GEO-oriented in wording, the actual behavior is limited to content scaffolding for a single page and does not perform publishing, distribution, repurposing, multi-channel adaptation, or any AI crawler visibility actions. This is a material mismatch in primary purpose and capabilities.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger guidance is broad enough to capture many ordinary content, marketing, documentation, or publishing requests, increasing the chance this skill activates outside its intended niche. Over-broad activation can cause prompt-scope hijacking, where a specialized skill injects an extensive workflow and assumptions into unrelated tasks, potentially displacing more appropriate skills or leading the model to over-collect context and produce misleading operational advice.

Vague Triggers

Medium

Confidence: 98% confidence
Finding: The instruction not to limit triggering to exact phrases leaves intent boundaries intentionally ambiguous, which can cause the skill to activate opportunistically on loosely related requests. In agent systems, ambiguous activation broadens the attack surface for misrouting and unwanted prompt injection through the skill's own workflow requirements, especially since it mandates a 9-step process unless the user opts out.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The eval prompt is broad enough to resemble ordinary marketing and content-planning work, which can cause the skill to be invoked outside its intended GEO-specific scope. Over-broad activation increases the chance of misrouting user requests, causing unintended behavior, reduced least-privilege control, and opportunity for prompt-scope abuse in adjacent workflows.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The request for a repeatable GEO publishing playbook uses ambiguous trigger language that overlaps with common repurposing and distribution tasks. This ambiguity can lead to unintended invocation on standard marketing requests, expanding the skill's operational scope beyond what users explicitly asked for and weakening routing safeguards.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Although the prompt mentions GEO-related outputs, the phrase 'end-to-end publishing and distribution plan' is still broad and can capture many routine publishing tasks without clear activation limits. In a skill designed to orchestrate cross-channel publication, this broadness makes accidental or excessive invocation more likely, which is dangerous because it can override more appropriate, narrower skills or expose downstream tooling unnecessarily.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: This code writes generated content to an arbitrary path supplied via --output, but the write path is not accompanied by a runtime notice, confirmation prompt, or inline comment/docstring warning that a file will be created or overwritten. The argparse help notes that output can be written to a path, but the actual write operation itself has no visible disclosure at the point of execution.

Static analysis

No suspicious patterns detected.