ClawHub
Back to skill

Security audit

gingiris-seo-geo-agent

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed SEO/GEO operations playbook that may use analytics and SEO service credentials, but the access is purpose-aligned and includes user-facing boundaries.

Install only if you want an agent to help run ongoing SEO/GEO work. Keep API keys in environment variables or a secrets vault, use project-limited credentials where available, and review any proposed content publishing, robots.txt, sitemap, IndexNow, or analytics changes before applying them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list contains generic phrases such as "SEO agent", "SEO SOP", and "autonomous SEO" that are broad enough to match many unrelated conversations. This can cause unintended invocation of the skill, exposing users to unsolicited operational guidance or causing the agent to take over tasks outside the user's actual intent.

Vague Triggers

Low
Confidence
78% confidence
Finding
The when-to-use section is written broadly enough to cover nearly any request about SEO, GEO, automation, or website operations, without strong exclusion criteria. This increases the chance the skill is selected in contexts where it is only partially relevant, leading to inappropriate guidance or accidental workflow initiation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.