Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly generates SEO blog files, but it also gives conflicting and detailed instructions for changing content inside a live UEESHOP editor draft.
Install only if you want a Lanthome-specific SEO content generator and you will keep it limited to local file generation. Review or remove the UEESHOP editor-injection section before use unless you explicitly want agents to manipulate drafts in that CMS under separate human approval.
The skill says 'Generate files only' and 'do not access UEESHOP,' but immediately follows with operational instructions for saving content into UEESHOP drafts. Contradictory guidance is dangerous because downstream agents may follow the more specific procedural steps and ignore the higher-level restriction, resulting in unintended CMS writes.
The skill claims it only generates files, but it also includes detailed browser-console automation for injecting and persisting content into the UEESHOP TinyMCE editor. That expands the skill from offline content generation into live CMS manipulation, which can enable unauthorized publishing workflow actions, content tampering, or accidental interaction with production systems.
The description explicitly limits the skill to creating English SEO blog content. This is a natural-language locale constraint, and the file does not offer the user a language choice or explain why English is mandatory as a justified region-specific requirement.
The workflow directs the agent to draft the metadata and English article as a fixed requirement. Under the policy, forcing a specific language without opt-in is a locale-policy issue unless the constraint is clearly justified.
The output specification requires the article body to exceed 2,000 English words, again imposing a fixed language requirement. No alternative locale handling or user choice is provided in the file.
The default invocation prompt is broad and can trigger the skill for any Lanthome product URL without defining user intent, authorization boundaries, or output safety constraints. In a content-generation skill that produces articles, HTML, metadata, links, and images, this increases the chance of misuse, accidental over-invocation, and generation of unreviewed or policy-violating marketing content.
The prompt explicitly instructs creation of an "English SEO article," which imposes a language choice in natural language without indicating user opt-in. This can violate language or locale policy when no rationale or alternative language selection is offered.
