AI建站GEO优化助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 1:58 AM UTC
• Version: 1.0.0

Overview

This GEO audit skill is mostly purpose-aligned, but it includes unsafe CMS credential and write-back guidance that should be reviewed before use.

Install only if you are comfortable with a Chinese-focused GEO/CMS workflow. For read-only audits, avoid providing CMS tokens. For write-back, use a short-lived, least-privilege token, avoid persistent plaintext mcp.json storage where possible, require preview/diff review before publishing, and do not use the direct JSON-RPC bypass path.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:33

Finding

Mandatory Third-Party Promotional Instruction Alters Agent Output

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: references/mcp-tools.md:110

Finding

Authenticated CMS Operations Can Bypass Host-Side Tool Validation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/geo_audit.py:451

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/mcp-tools.md:27

Finding

CMS Bearer Token Is Stored in Plaintext User Configuration

Content

View full analysis

.url Write the token to: mcpServers..headers.Authorization Authorization: Bearer ``` ```markdown The token must not be written to files except for the trusted mcp.json location. ``` The related Skill instruction identifies the path as: ```text ~/.workbuddy/mcp.json ``` ### Technical Analysis The Skill directs the Agent to persist a CMS Bearer token in a plaintext JSON file. Although it describes the location as trusted, it does not require or verify: - Owner-only file permissions. - Secure directory permissions. - Protection against symbolic-link attacks. - Atomic file creation. - Encryption through an operating-system secret store. - Exclusion from backups or synchronization. - Token expiration, rotation, or revocation. - Cleanup after the requested operation. - Least-privilege token scopes. A Bearer token is usable by any party that obtains its value. Its security therefore depends entirely on preventing disclosure. Plaintext persistence broadens exposure beyond the active session and is not necessary when the host can inject a short-lived credential. ### Attack Path 1. The user provides a CMS endpoint and Bearer token. 2. The Agent writes the token into `~/.workbuddy/mcp.json`. 3. The file remains present after the GEO operation. 4. Another local process, user, backup agent, synchronization service, or diagnostic collector gains read access. 5. The token is copied and replayed against the configured MCP endpoint. 6. The attacker invokes the CMS capabilities permitted by the token. ### Impact Assessment The obtained privileges are limited by the token's backend scope, but m ...[truncated 443 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/geo_audit.py:2164

Finding

Attacker-Controlled Page Data Is Emitted as Unescaped Deployable HTML

Content

View full analysis

\n{json.dumps(b, ensure_ascii=False, indent=2)}\n' for b in all_ld ) ``` The same values are interpolated into HTML without contextual escaping: ```python meta_suggestions = [ f'{site_name} | {a["industry"]["top"] or "专业服务"}', f'', '', f'', ] ``` ### Technical Analysis `org_name` and `site_name` are derived from the audited page's metadata, schema, title, or visible text. An attacker who controls the audited page can therefore influence these values. The output is described as directly pasteable and may later be written into a CMS. However: - Text inserted into `` is not HTML-escaped. - Text inserted into quoted `content` attributes is not attribute-escaped. - JSON serialization does not make a string safe for embedding in an HTML `<script>` element. - A value containing a script-closing sequence can terminate the JSON-LD element in an HTML parser even if it remains valid JSON text. - There is no final DOM validation or sanitization before the generated content is presented for deployment. This creates a second-orde ...[truncated 1617 chars]

Remediation

View remediation

`, `&`, and script-closing sequences. 4. Prefer generating structured JSON separately and let a trusted CMS component create the script element. 5. Validate generated snippets by parsing them with an HTML parser and confirming that exactly the expected elements are produced. 6. Sanitize organization and brand names with strict length and character policies. 7. Require a visible diff and explicit confirmation before CMS deployment. 8. Deploy to a draft or preview environment first. 9. Use a Content Security Policy as defense in depth, while not relying on it as the primary fix. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The skill instructs users to place an MCP endpoint and Bearer token into a user-level configuration file under ~/.workbuddy/mcp.json. Storing sensitive credentials in a broadly accessible local config increases the blast radius of credential theft from local compromise, other tools reading the file, or accidental reuse beyond the intended session.

Content

Scanner excerpt · references/mcp-tools.md (reported line 3)May include surrounding context.

md

# CMS MCP 写回映射（mcp-tools）

本技能在「目标站为支持 MCP 的 CMS 且需执行修改」时，经 MCP 回写 GEO 优化内容。MCP 地址与 Bearer Token 由用户提供（写入用户级 `~/.workbuddy/mcp.json` 的 `mcpServers.<name>.url` 与 `mcpServers.<name>.headers.Authorization`，或由会话提供的 MCP 服务注入）。

## 向用户索取 MCP 地址与访问 Token（必读，写操作前必做）

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

This section operationalizes writing the MCP URL and Authorization header into mcp.json as the 'single source of truth,' normalizing persistent secret storage for write-capable CMS access. Because the token authorizes content modification, compromise of that config can lead to unauthorized page edits, FAQ publication, or broader CMS abuse.

Content

Scanner excerpt · references/mcp-tools.md (reported line 27)May include surrounding context.

text

### 拿到后如何处理
1. **写入配置（单一数据源）**：把地址写入 `mcp.json` 的 `mcpServers.<name>.url`，Token 写入 `mcpServers.<name>.headers.Authorization`（`Authorization: Bearer <token>`）。若宿主已托管该 MCP 服务，则直接复用会话内已连接的同名服务，无需重复索取。
2. **验证连通性（必须，写前第一动作）**：调用 `test` 工具进行连通性检测——
   - **通过**：服务可达、鉴权通过，继续用 `tools/list` 确认 `list_page`、`save_ai_page`、FAQ 工具等可用。
   - **失败**：立即停下，向用户反馈「地址或 Token 无效 / 无权限」，**不得猜测重试或降级到伪造数据**。

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Although the text says the token should not be echoed or logged, it still explicitly relies on reading the token from mcp.json for backend operations. That creates a durable secret source that other local processes, plugins, or later workflows may access, making accidental disclosure or misuse more likely than transient in-memory handling.

Content

Scanner excerpt · references/mcp-tools.md (reported line 37)May include surrounding context.

md

### 安全红线
- Token 仅由 MCP 客户端放入 `Authorization: Bearer`，**不回显、不落文件（除 `mcp.json` 受信位置外）、不出现在任何报告/日志/截图**。
- 未拿到 Token 前，**只做只读分析，不调用任何写工具**（`save_ai_page` / FAQ 写入工具等）。
- 直连后端脚本（见文末）从 `mcp.json` 读 Token，保持单一数据源；仅可信本地环境使用。

## 前置要求（写操作前必做）
1. 已按上文「向用户索取 MCP 地址与访问 Token」完成索取、写入与连通性验证。

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 94% confidence

Finding

This line combines two risky behaviors: reading a bearer token from mcp.json and using it in a direct backend JSON-RPC path that bypasses host-side validation. Together, this enables a lower-friction route to authenticated write or delete actions outside normal guardrails, increasing the chance of unauthorized or insufficiently validated CMS changes.

Content

Scanner excerpt · references/mcp-tools.md (reported line 110)May include surrounding context.

md

JSON-LD 中的网址、Logo、图片地址必须是完整 URL（优先 `FnGetHost(1)` 拼接或 `FnGetCurrentUrl()`）。

## 直连后端提示
若宿主 `DeferExecuteTool` 的本地 ajv 校验因 `oneOf`/`coerceTypes` 误拦截带 `pageId` 的写工具（如 `save_ai_page`、`del_page`），可改用直连后端脚本（从 `mcp.json` 读 Token，POST JSON-RPC：`initialize` → `notifications/initialized` → `tools/call`）绕过宿主校验。仅在可信本地环境使用，且仍须遵守上述数据标签与真实数据红线。

## 写后验证
回写后：① 在 CMS 预览确认页面正常；② 重新 `analyze`（或 `validate` 对比基线）确认 GEO Score 提升、schema 类型出现、无模板绑定破坏。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs network crawling, local file reads, and file writes, yet it declares no tool scope or permissions boundary. In an agent environment, that mismatch can enable broader-than-expected filesystem and network access, increasing the risk of unauthorized crawling, local data exposure, or unintended modification if the skill is invoked automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The when_to_use field contains broad language like 'or any' related GEO-style diagnosis, which can cause the agent to invoke this skill for loosely related requests. Because the skill includes crawling, analysis, credential solicitation, and optional write-back behavior, overbroad triggering raises the chance of unnecessary external access or prompting users for sensitive MCP tokens outside the narrow intended use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document specifies that industry classification is based on '12 个中文行业词库', which imposes a Chinese-language locale assumption in the skill's analysis criteria. The file does not indicate any user opt-in, alternative locale handling, or that the skill is limited to a China-specific deployment context.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill is written as mandatory operating guidance in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-only compliance or regional context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly instructs operators to bypass host-side validation by directly calling the backend JSON-RPC API when local AJV checks block write tools. Even if framed as a workaround for false validation failures, this defeats a security control boundary and can enable unsafe write or delete operations with less scrutiny, especially because the same section references destructive tooling such as page deletion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The fetch function always sends an Accept-Language header preferring zh-CN, which imposes a specific locale without any user opt-in or documented justification. This is a natural-language locale policy issue because it can change site content selection and behavior based on a forced language preference.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The crawl function performs HTTP requests to arbitrary URLs and writes fetched HTML plus a manifest to disk, but this operation has no confirmation prompt, no user-facing disclosure at the point of action, and no warning comment/docstring describing the side effects. For a code file, these are safety-relevant operations because they affect external systems and local storage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The natural-language instruction states that the skill is limited to Twig version 1.3 and imposes version-specific authoring constraints. This is a forced language/format constraint presented as a blanket rule, without offering a user choice or documenting why that constraint is required for all uses of the skill.

Content

No source excerpt is available for this finding.