Security audit

Seo Blog Writer

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real SEO article-writing workflow, but it asks for unnecessarily broad execution authority and fetches arbitrary external links without clear destination controls.

Install only if you are comfortable with a hands-off SEO workflow that searches the web, fetches many public pages, and writes output files locally. Prefer running it in a sandbox limited to a chosen output directory and public HTTP/HTTPS fetching; avoid granting full execution privileges to a subagent.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:46
Finding: Unrestricted Execution Context Requested for Bounded File and Network Operations
Content: View full analysis
**Why `security: "full"`?** This skill writes article drafts, QA reports, and schema files to disk incrementally (crash-safe execution). Link verification uses `curl`/`web_fetch` to check URLs. Both operations require exec access. If you prefer not to grant this, run the skill in your main session rather than as a subagent — behavior is identical. ``` ### Technical Analysis The Skill explicitly requests `security: "full"` for operations limited to writing generated artifacts and checking URLs. Neither operation inherently requires unrestricted command execution or broad access to the host filesystem. This violates the principle of least privilege. The recommendation to execute the Skill directly in the main session does not mitigate the issue because it merely moves execution into another context that may already possess broad permissions. The Skill also processes several classes of untrusted input, including: - User-provided topics and domains. - Website content. - Search-engine results. - Competitor pages. - External citations and links. If untrusted content affects later tool selection or command construction, the unrestricted execution context substantially increases the consequences. The reviewed file does not itself contain a malicious shell command, so exploitation depends on unsafe agent behavior, another compromised component, or insufficient isolation in the runtime. ...[truncated 1481 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:928
Finding: External URLs Are Fetched Without a Documented SSRF Validation Policy
Content: View full analysis
200 chars of readable text → PASS - Content is empty, error thrown, or < 50 chars → FAIL (mark as broken) - Content contains "not found", "page doesn't exist", "404" → FAIL - Content looks like a generic homepage when specific page was intended → FAIL 3. Content relevance check: - Do the first 300 chars relate to the claim being cited? - Is the context appropriate (not pulling positive quotes from negative reviews)? 4. If FAIL: search for alternative source, update link, log replacement in QA report Source quality tiers (assess from domain, not HTTP headers): - TIER-A: Official sites, government, major research institutions, established media ``` ``` ### Technical Analysis The Skill directs the agent to fetch every external link included in an article but does not define destination security controls. The URLs may originate from user input, supplied product context, crawled websites, search results, discovered citations, or generated article content. The instructions do not require: - Restricting schemes to HTTP and HTTPS. - Rejecting URLs containing embedded credentials. - Blocking loopback, private, link-local, multicast, or reserved addresses. - Blocking cloud instance metadata endpoints. - Resolving hostnames and checking the resulting IP addresses. - Revalidating destinations after redirects. - Restricting crawling to user-confirmed public hosts. Consequently, the workflow can act as an SSRF primitive i ...[truncated 1734 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are very broad and overlap with ordinary user requests like 'write a blog post' or 'write about [topic]'. In combination with the skill's disk-writing behavior and request for elevated subagent permissions, this raises the risk of accidental invocation and unintended execution of a powerful workflow without the user meaning to run this specific skill.
Content: No source excerpt is available for this finding.

Scope Creep

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly asks for security: "full"/exec-capable subagent execution even though its declared needs are web search, web fetch, and disk writes. That creates a privilege escalation path where a broadly-triggered content-writing skill can obtain shell-level capabilities and perform actions beyond its manifest, increasing the blast radius if the skill is misused, compromised, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Excessive Permissions

Low

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
This is a heavy, multi-phase skill. Incremental disk writes and offset-read verification are mandatory — see the long-running task note above.

When spawning as a subagent, file writes and link verification (Phases 1–5) require exec permissions:

text
sessions_spawn(

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: At L0604 the document says Phase 3.1 checks were already executed inline during writing. But L0816-L0818 explicitly states the detection approach is to generate content in sections and 'Do not attempt real-time prevention,' which contradicts the earlier instruction to run the check immediately after each H2 while drafting. This is an internal intent/documentation contradiction rather than mere incompleteness.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.