SEO OwlsClaw - Research * Plan * Write

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:30 AM UTC
• Version: 0.9.2

Overview

This SEO content skill is not malicious, but it needs Review because its deploy-ready HTML path and saved brief/plan files are not controlled tightly enough.

Before installing, treat generated HTML as draft code: review and sanitize it before publishing, especially links, meta attributes, and JSON-LD. Also require explicit confirmation for seobrief/seoplan saves, check the exact destination path, and avoid overwriting existing strategy or brief files unless intended.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: BRAIN_ARCHITECTURE.md:317

Finding

Context-Unaware Template Substitution Enables HTML and JSON-LD Injection

Content

View full analysis

str: """Replace ALL {PLACEHOLDER} text with actual values.""" return template_text.format(**variables) ``` ```text Rules: - Every {PLACEHOLDER} in the template must be replaced — no placeholder may survive into output - If a variable is missing from the dictionary → flag it, ask the user for the value, do not output {PLACEHOLDER} text - Schema variables ({SCHEMA_*}) are substituted in the same pass ``` Representative sinks from `TEMPLATES/product_new_template.md:7-28`: ```html {TITLE} — {DESCRIPTION} ``` Representative body and URL sinks from `TEMPLATES/product_new_template.md:35-88`: ```html

{H1_TITLE_BRAND_PRODUCT_KEYWORD}

{HERO_SUBHEADLINE_TECHNICAL_BENEFITS} — Perfect for {TARGET_USE_CASES}

{DISPLAY_PRICE_EUR} / unit

{H2_DESCRIPTION_OVERVIEW_FEATURES}

{DESCRIPTION_CONTENT_400_CHARS_MAX}

...[truncated 2942 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:304

Finding

Mandatory Brief and Plan Saves Bypass the Declared File-Write Confirmation Boundary

Content

View full analysis

.md` and can be passed to `write` or `writehtml` using the `--from-brief` flag ``` ```text The plan is saved to `SEO_PLANS/.md` and can be referenced in any `seobrief` command using the `--plan .` flag. ``` ### Technical Analysis The Skill establishes an explicit least-privilege rule: every filesystem write requires user confirmation. Its operative workflows do not implement that gate. Instead, issuing `seobrief` or `seoplan` leads to a mandatory save step. A request to generate a brief or plan expresses intent to receive the requested SEO artifact, but the Skill's own capability declaration requires an additional confirmation before persisting it. No such confirmation is present between generation and the save operation. The documentation also does not define collision handling, overwrite protection, path canonicalization, or create-exclusive semantics. This inconsistency can cause the Agent to modify p ...[truncated 1516 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (63)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · BRAIN_ARCHITECTURE.md (reported line 273)May include surrounding context.

Zone A marker in output HTML:

html

<!-- ZONE:AI -->
<section>...factual content...</section>
<!-- /ZONE:AI -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · OUTPUT_EXAMPLES/TEST_WORKFLOW.md (reported line 43)May include surrounding context.

Before Replacement (Static Template):

html

<!-- STATIC TEMPLATE → All Placeholders Still Present! -->
<title>{TITLE}</title>
<h1>{H1_TITLE}</h1>
<p>{HERO_SUBHEADLINE}</p>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · OUTPUT_EXAMPLES/blog_post_example.html (reported line 1)May include surrounding context.

html

<!-- Page Type: Blogpost (Example Output) -->
<!-- Generated by SEOwlsClaw v0.1 | SEO with Owls Claw (See Owls Claw) -->

<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · OUTPUT_EXAMPLES/landing_page_example.html (reported line 1)May include surrounding context.

html

<!-- Page Type: Landingpage (Example Output) -->
<!-- Generated by SEOwlsClaw v0.1 | SEO with Owls Claw (See Owls Claw) -->
<!-- Passes SEO_RULES/landingpage.md + SEO_CHECKS/page-type-specific-checks.md — Landingpage required + recommended checks -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · OUTPUT_EXAMPLES/landing_page_example.html (reported line 98)May include surrounding context.

html

<p>Orders placed during the sale window ship within 24 hours, and every item still carries our full lifetime warranty. The discount applies to the price, never to the coverage. We run this sale once a year, at the end of summer, when our warehouse team clears space for next season's colorways. That's the only reason the discount exists: it isn't a markdown on gear nobody wanted, it's a clearance on the same bestsellers reviewed in our hiking gear guides.</p>
    </section>

    <!-- HOW THE SALE WORKS H2 -->
    <section class="how-it-works">
        <h2>How the Hiking Gear Sale Works</h2>
        <p>The 25% discount applies automatically at checkout on every in-stock item across hydration, carry, and layering categories. No code required. Prices update the moment the sale starts and revert the moment it ends, so what you see at checkout is what you pay, with no surprise fees added afterward. If an item sells out mid-sale, the listing is marked unavailable rather than left live with a broken checkout, so you'll never place an order we can't fulfill.</p>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · OUTPUT_EXAMPLES/landing_page_example.html (reported line 130)May include surrounding context.

html

<p>This event is built for hikers who already know which gear they want and are simply waiting for the right price, not for anyone chasing a bargain on gear they'll replace in a season. If you've bookmarked the EcoSmart water bottle, added a trail pack to your cart and closed the tab, or asked a friend which rain shell holds up on multi-day trips, this is the week those decisions get 25% cheaper. New to the brand? Start with our best-reviewed pieces: the EcoSmart water bottle and our signature trail pack, both linked below.</p>
    </section>

    <!-- SOCIAL PROOF H4s -->
    <section class="social-proof">
        <h4>What Our Customers Say</h4>
        <p class="rating-summary">Rated 4.8 out of 5 from over 340 verified buyers.</p>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · OUTPUT_EXAMPLES/photo_post_example.html (reported line 1)May include surrounding context.

html

<!-- Page Type: Socialphoto (Example Output) -->
<!-- Generated by SEOwlsClaw v0.1 | SEO with Owls Claw (See Owls Claw) -->

<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SEO_CHECKS/schema-markup.md (reported line 61)May include surrounding context.

md

<meta name="description" content="{META_DESCRIPTION}">
  <link rel="canonical" href="{URL_CANONICAL}">

  <!-- ✅ SCHEMA GOES HERE — after meta, before </head> -->
  <script type="application/ld+json">
  { ... }
  </script>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SEO_CHECKS/schema-markup.md (reported line 704)May include surrounding context.

Full Template — Site-Wide (Homepage Only)

html

<!-- Organization Schema — inject on homepage only -->
<script type="application/ld+json">
{
  "@context": "https://schema.org",

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

| `SKILL.md` | Entry point — this file | Always loaded first |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

| `seo-output-quality-checklist.md` | Pre-output quality gates | Step 6.5 before final output |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES/blog_post_template.md (reported line 1)May include surrounding context.

md

<!-- Page Type: Blogpost -->
<!-- Generated by SEOwlsClaw v0.6 -->

<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES/blog_post_template.md (reported line 2)May include surrounding context.

md

<!-- Page Type: Blogpost -->
<!-- Generated by SEOwlsClaw v0.6 -->

<!DOCTYPE html>
<html lang="en">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES/blog_post_template.md (reported line 43)May include surrounding context.

md

<p>{INTRO_CONTENT_500_CHARS_MAX}</p>
    </section>

    <!-- MAIN BODY H2s with Subsections -->
    <section class="main-body">
        <h2>{H2_SECTION_1_TITLE}</h2>
        <p>{BODY_CONTENT_500_CHARS_MAX}</p>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES/faq_page_template.md (reported line 1)May include surrounding context.

md

<!-- Page Type: FAQ -->
<!-- Generated by SEOwlsClaw v0.7 -->

<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES/landing_page_template.md (reported line 1)May include surrounding context.

md

<!-- Page Type: Landingpage -->
<!-- Generated by SEOwlsClaw v0.1 | SEO with Owls Claw (See Owls Claw) -->

<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES/product_new_template.md (reported line 1)May include surrounding context.

md

<!-- Page Type: Productnew -->
<!-- Generated by SEOwlsClaw v0.1 | SEO with Owls Claw (See Owls Claw) -->

<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES_SOCIAL/photo_post_template.md (reported line 1)May include surrounding context.

md

<!-- Page Type: Socialphoto -->
<!-- Generated by SEOwlsClaw v0.1 | SEO with Owls Claw (See Owls Claw) -->

<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES_SOCIAL/photo_post_template.md (reported line 59)May include surrounding context.

md

</body>
</html>

<!-- Editing Guide: Change any {PLACEHOLDER} text directly in this file before generation -->
<!-- Photo posts focus on visual SEO with alt text, hashtags, and platform-specific formatting! -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · TEMPLATES_SOCIAL/video_post_template.md (reported line 1)May include surrounding context.

md

<!-- Page Type: Socialvideo -->
<!-- Generated by SEOwlsClaw v0.1 | SEO with Owls Claw (See Owls Claw) -->

<!DOCTYPE html>

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Lines L005-L007 state that the document defines the complete processing logic and that all steps are executed in the listed order with 'no exceptions.' Later lines explicitly introduce exceptions, including seoplan skipping Steps 4-5 (L065-L066), Steps 3-7 not running for seoplan (L170-L171), and Step 2f being skipped for seoplan/seobrief (L190-L191). This is an active contradiction in the documentation about control flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The architecture specifies seoplan-Step G Output + Save and elsewhere says seobrief content is saved, but it does not require a clear user-facing disclosure or consent before persistence. In an agent context, silent saving of user prompts, niche research, or brand strategy can create privacy, compliance, and data retention risks, especially if users assume outputs are ephemeral.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly requires confirmation before writing files for research, write, writehtml, and checks, but seobrief is documented to save briefs to SEO_BRIEFS/<brief-id>.md automatically with no comparable consent step. This creates an inconsistent safety boundary where a user may reasonably expect no disk writes without approval, yet invoking seobrief causes persistent local file creation that could overwrite files, leak sensitive prompts into storage, or be abused for workspace pollution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

seoplan is documented to save output to SEO_PLANS/<plan-id>.md automatically, again without the confirmation controls required elsewhere in the skill. Because plans are generated from user-supplied niche/topic input and may be repeatedly invoked, this enables silent persistent writes that can accumulate files, expose potentially sensitive strategy data on disk, or surprise users operating in trusted repositories or constrained environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file instructs the agent to always fall back to base locale values, which are explicitly English and US-oriented (en, en-US, US) when no override is supplied. This creates a language/locale policy risk because users are placed into a specific locale by default without an explicit opt-in or selection mechanism documented in this file.

Content

No source excerpt is available for this finding.