Seo Audit Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:41 AM UTC
• Version: 2.0.0

Overview

This SEO-audit skill is mostly transparent, but its URL fetching and saved HTML reports have security gaps that deserve review before use.

Install only if you are comfortable letting the skill fetch user-provided URLs from your machine and create local HTML reports. Avoid auditing untrusted or attacker-supplied URLs until redirect/DNS SSRF handling and HTML escaping are fixed; pin dependencies before use in sensitive environments.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:346

Finding

Mandatory Promotional Output and External Project Backlink

Content

View full analysis

**Want a deeper analysis?** > This was a basic SEO audit covering site-level signals and core on-page checks. > For advanced technical SEO, content quality scoring, structured data analysis, and full crawl-based findings, use the `seo-audit-full` skill. ``` `assets/report-template.html:896-913`: ```html

Want a Deeper Analysis?

This was a seo-audit — Basic tier. It covers robots.txt, sitemap.xml, canonical, TDK, H1, and heading structure. Upgrade to seo-audit-full to unlock advanced technical checks, social tags, content quality analysis, GSC crawl status, and competitor benchmarking.

Say: deep audit: {{url}}

Powered by OpenSource Project - seo-audit-skill · Basic SEO Audit Report · {{generated_date}}

``` ### Technical Analysis The Skill requires an Agent to append promotional content to every generated audit report, regardless of whether the user requested recommendations for another Skill. The bundled report template also inserts a fixed external backlink to the project repository. Because these requirements are loaded as operational Skill instructions, they alter the user-facing output independently of the audit task. The behavior is persistent across all reports generated using the Skill and is not presented as an optional, user-controlled feature. ### Attack Path 1. A user requests an ordinary SEO audit. 2. The Agent loads the ...[truncated 774 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/check-page.py:91

Finding

SSRF Protection Bypass Through Redirects, DNS Rebinding, and Incomplete Address Validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/report-template.html:380

Finding

Untrusted Website Content Can Be Inserted into Generated HTML Without Required Escaping

Content

View full analysis

--audit.html` **Template placeholders** — fill each independently: | Placeholder | Content | |---|---| | `{{summary_verdict}}` | One sentence: total checks run, how many failed/warned/passed | | `{{summary_critical_html}}` | `

` per critical (fail) item, or `

None

` | | `{{summary_warnings_html}}` | `

` per warning item, or `

None

` | | `{{summary_passing_html}}` | `

` per passing check, or `

None

` | ``` `SKILL.md:105-110`: ```markdown **How to use the JSON output:** - Map each field's `status` → `pass` / `warn` / `fail` / `error` directly to the report check table - Use each field's `detail` string as the starting point for the Evidence line in findings - Do not contradict the script output unless you have additional observable evidence ``` `assets/report-template.html:380-442`: ```html

{{report_title}}

URL: {{url}} Audit Level: {{audit_level}} Created: {{generated_date}}

{{summary_verdict}}

{{summary_critical_html}}

{{summary_warnings_html}}

{{summary_passing_html}}

Remediation

View remediation

`. - Attribute values: additionally escape quotation marks. - URLs: validate the scheme and serialize through a dedicated URL sanitizer. 4. Do not construct table rows or findings through raw string concatenation. 5. Keep trusted template markup separate from untrusted text values. 6. If limited rich text is necessary, sanitize it with a maintained allowlist-based HTML sanitizer. 7. Reject dangerous URL schemes such as `javascript:` and restrict links to expected HTTP(S) destinations. 8. Add a restrictive Content Security Policy, for example disallowing scripts and limiting network connections. 9. Add regression tests using payloads in titles, H1 elements, meta descriptions, canonical URLs, and JSON-LD values. 10. Document the escaping requirement explicitly in `SKILL.md`. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:84

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is a basic SEO audit, but the behavior includes broader crawling/fetching features, saving fetched HTML locally, and user-agent/Googlebot-style fetching. That mismatch can cause operators or routing systems to invoke the skill under a lower-risk assumption while it performs materially more sensitive network collection and local data handling than advertised.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/report-template.html (reported line 392)May include surrounding context.

html

<main>

  <!-- Audit Summary -->
  <section>
    <h2>Audit Summary</h2>
    <div class="section-body">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/report-template.html (reported line 568)May include surrounding context.

html

</table>
      -->

      <!-- E-E-A-T Infrastructure: trust pages existence + reachability -->
      {{eeat_checks_html}}
      <!--
        Start with: <div class="subsection-label">E-E-A-T Trust Pages</div>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill directs the agent to perform network access, read local reference/template files, and write reports, but it declares no explicit tool scope or permissions boundary. In an agent environment, this increases the risk of overbroad tool use, unintended file access, or execution in contexts where users did not expect local file creation and external fetching.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough to match generic requests like 'analyze my URL' or 'what's wrong with my page,' which may activate networked auditing and file-writing behavior outside clear SEO-specific consent. In agentic systems, ambiguous routing can lead to unexpected external requests against user-supplied URLs and generation of local artifacts without the user realizing the skill's full behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs saving an HTML report locally and then opening it, but it does not provide an explicit safety notice or obtain prior consent for file creation and launching a local file. This can surprise users, create unwanted local artifacts, and open a browser-rendered HTML file generated from externally sourced content, which raises risk if report content is not safely escaped.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes generic phrases such as "analyze this URL," "page audit," and "SEO report," which are broad enough to match benign or unrelated user intents and cause unintended skill activation. In an agent environment, over-broad routing can lead to the wrong tool being invoked, producing irrelevant actions or unexpected network access against user-supplied URLs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default HTTP headers hard-code Accept-Language: en-US,en;q=0.5, which instructs remote sites to return English-language content regardless of the user's actual language preference. This is a natural-language locale policy issue because the skill imposes a specific language without offering a choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The request headers force Accept-Language: en-US,en;q=0.5, which imposes a specific language/locale preference on fetched content. This is a natural-language policy concern because the script does not offer a user choice or explain why English localization is required for its function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file contains natural-language content in Chinese in a code comment while the HTML document is marked with lang="en". Under the policy scope, forcing or mixing a specific language without opt-in or justification can violate language/locale expectations for maintainers or downstream users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and CLI description say the tool performs page-level checks for H1, title tag, meta description, and canonical, but the code also implements and returns a separate URL slug audit. That extra behavior is SEO-related, but it exceeds the explicitly documented scope of this script.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The argument parser description says the script runs page-level SEO checks for H1, title, meta description, and canonical, but the main output also includes a url_slug check. This is a documentation-to-code divergence rather than merely an implementation detail, because it changes what the script audits and returns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default HTTP headers hard-code Accept-Language: en-US,en;q=0.5, which imposes a specific language/locale preference on requests regardless of user choice. This is a natural-language locale policy concern because the skill does not offer any language selection or document a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The default request headers hard-code "Accept-Language: en-US,en;q=0.5", which imposes a specific language/locale preference on all fetches. This is a natural-language policy concern because the tool does not offer users a locale choice or document a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.