Security audit

AKA SEO Wireframe

Security checks for vulnerabilities and agentic risk

Overview

The skill is not plainly malicious, but it needs review because it can run unpinned external code and publish or modify many WordPress pages.

Review carefully before installing. Use only in a staging site first, pin and verify any npm package before running it, run dry-run/report-only modes before writes, use a dedicated low-privilege WordPress account, revoke the application password after deployment, keep backups, and manually verify generated content, ratings, claims, and compliance before publication.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: references/orchestrator.md:192
Finding: Unpinned Third-Party Package Download and Execution via npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/wordpress-deployer.md:298
Finding: Hard-Coded Aggregate Rating Can Publish Fabricated Trust Signals
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invocation description includes generic phrases such as "authority site," "content wireframe," and especially "200 page site" alongside broad intents like wanting "topical authority content" or "topical clustering." In a manifest/markdown context, these triggers are not tightly bounded and could match ordinary user requests about SEO planning rather than clear intent to invoke this specific skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest says the skill produces structured content for any platform and that WordPress deployment is only an optional export. This file presents the orchestrator as a 'WordPress Orchestrator' and defines the full automation workflow with deployment to WordPress as a core step, which materially narrows and changes the described scope from platform-agnostic generation to WordPress-centric orchestration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The deploy workflow describes installing themes, creating pages, modifying navigation, inserting metadata, and uploading assets without a prominent warning about the impact on a live WordPress site. In a skill that automates site changes, lack of clear caution and confirmation can lead to unintended destructive or business-impacting modifications in production.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest frames WordPress deployment as an optional export and not a requirement of using the skill. In this file, the 'auto' command's documented workflow culminates in 'Deploy to WordPress' as a standard step, making WordPress deployment part of the default automation behavior rather than an optional add-on.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Full automation mode is documented as checking prerequisites, generating content, processing links, and deploying to WordPress without a clear warning that it will automatically modify and publish site content. Because this combines content creation and live deployment in one path, a user may trigger broad site changes with insufficient awareness, making accidental production impact significantly more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The documentation instructs users to run npx aka-wireframe-wp without a pinned version, which can fetch and execute whatever package version is current at runtime. If the package is updated maliciously, compromised upstream, or changed incompatibly, users could execute unreviewed code with the privileges of their local environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: This is a second instance of the same supply-chain risk: invoking npx aka-wireframe-wp without version pinning causes dynamic retrieval and execution of the latest package version. In a skill that coordinates generation and deployment, that increases the blast radius because the fetched code may also alter content, credentials, or live sites.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file applies to SQP-2, and it explicitly instructs users to 'Deploy content' after copying prompts into an AI tool. Although later lines mention reviewing output, the document does not provide a clear warning that generated content may be inaccurate, noncompliant, or harmful if published directly to a live site.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The bulk WordPress import script prompt encourages generating code that can create and publish large numbers of pages, modify metadata, and assign templates at scale without any safety guardrails. In a skill explicitly aimed at producing 200+ page sites, this increases the chance of mass unintended site changes, accidental publication, duplicate content, or destructive operations if a user runs generated code without proper staging and review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises a --fix mode that can automatically modify deployed WordPress pages, metadata, schema, image names, and other site content, but the file does not provide an explicit safety warning, confirmation requirement, backup requirement, or dry-run-first guardrail before changes are made. In a production SEO workflow, silent or insufficiently gated write actions can lead to unintended content changes, broken formatting, SEO regressions, or bulk modifications across many pages.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This skill describes actions that can create, update, publish, and reconfigure a live WordPress site, including theme activation, permalink changes, navigation changes, and SEO metadata updates, but it does not prominently warn the operator that these are state-changing production actions. In an agent setting, that omission increases the chance of accidental live-site modification because the content presents deployment as routine and 'safe to retry' without an explicit confirmation or environment-safety warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs batch generation that creates many files under generated-content/hub-* but does not explicitly warn that existing files may be overwritten or replaced. In an automation context, silent bulk writes can cause accidental content loss or repository churn, especially if users rerun generation on an existing project.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: This markdown section instructs users to create a lead magnet to generate email subscribers and a post-download email sequence, which implicates collection and use of personal data. The document does not include any caution about obtaining consent, handling subscriber data appropriately, or complying with applicable email marketing rules.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.