ClawHub
Back to skill

Security audit

Lesishu SEO Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed SEO guidance skill with optional local PDF reporting, not a hidden or autonomous system-access tool.

Reasonable to install for SEO research and audits. Treat PDF generation as optional, install ReportLab in a virtual environment, and do not let the skill send outreach, collect emails, or inspect third-party domains unless you have authorization and comply with privacy, platform, and anti-spam rules.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
scripts/README.md:8
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: scripts/README.md:8
Vulnerability Type: Supply-chain risk from an unpinned dependency
Risk Level: Low

Complete Code Snippet:

bash
pip3 install reportlab    # Python 3.8 must pin reportlab<4.3

Technical Analysis

The documented PDF setup installs reportlab without pinning an exact reviewed version or verifying artifact hashes. The comment only applies a non-exact upper constraint for Python 3.8 and does not protect other environments. No lockfile, hash manifest, or trusted package-index requirement is supplied.

Consequently, installation behavior can change over time as the package index resolves newer releases and transitive build dependencies. If the package, its distribution artifacts, its build dependencies, or the configured package index were compromised, installation or subsequent import could run attacker-controlled Python code.

The dependency name appears legitimate, and the audited project does not itself retrieve or execute a remote payload. This is therefore an insecure dependency-management practice rather than evidence of malicious intent.

Attack Path

  1. A user requests the optional PDF-report functionality.
  2. The user follows scripts/README.md and runs the documented pip3 install reportlab command.
  3. pip resolves the currently available package and any required build dependencies from its configured index.
  4. A compromised release, artifact, build dependency, or package index supplies attacker-controlled code.
  5. That code executes during package installation, wheel building, or later when the report generator imports ReportLab.

Exploitation depends on an upstream or package-index compromise; no direct compromise is present in the audited repository.

Impact Assessment

Malicious dependency code would execute with the privileges of the user running pip or the PDF generator. It could potentially access that user' ...[truncated 273 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin ReportLab to an exact version reviewed and tested by the project, for example through a version-controlled requirements file.
  2. Record artifact hashes and install with pip --require-hashes.
  3. Pin and hash all transitive or build-time dependencies where applicable.
  4. Use a trusted package index explicitly and avoid unreviewed mirrors.
  5. Prefer binary wheels from verified sources and prevent unexpected source builds where operationally feasible.
  6. Run installation and PDF generation in an isolated virtual environment without administrator privileges.
  7. Add a documented dependency-update process that reviews release notes, provenance, and security advisories before changing the pin.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (168)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose is an SEO guidance skill, but associated behavior includes PDF font registration, system font discovery, stylesheet patching, and font self-tests. That mismatch increases risk because reviewers and users may approve the skill for SEO advice while overlooking auxiliary code paths that touch the local system and expand attack surface.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references-google/301-redirects.md (reported line 502)May include surrounding context.

md
<head>
    <meta http-equiv="refresh" content="0; url=https://example.com/newlocation">
    <title>Example title</title>
    <!--...-->

Here's an example of the HTTP header equivalent, which you can inject with server-side scripts:

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references-google/robots-meta-tag.md (reported line 618)May include surrounding context.

md
<div data-nosnippet>not in snippet</div>
    <div data-nosnippet="true">also not in snippet</div>
    <div data-nosnippet="false">also not in snippet</div>
    <!-- all values are ignored -->
    
    <div data-nosnippet>some text</html>
    <!-- unclosed "div" will include all content afterwards -->

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill manifest declares no explicit tool scope, yet the skill references capabilities that imply file access and environment interaction. Even if those capabilities are only used for report generation or local inspection, the absence of a least-privilege declaration makes the effective trust boundary unclear and can allow broader access than users or reviewers expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation trigger is broad enough to fire on ordinary discussion of SEO-related topics, not just explicit requests to use this skill. Over-broad invocation can cause unintended context switching, unexpected file or environment access via linked features, and accidental execution of auxiliary functionality such as report generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This section gives operational guidance for programmatically discovering author email addresses, validating them, and rapidly preparing outreach lists at scale, but it does so without any warning about consent, privacy, platform terms, or anti-spam compliance. In an agent skill context, these instructions can be directly repurposed to harvest contact data and facilitate unsolicited bulk outreach, increasing the likelihood of privacy abuse and spam campaigns.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation guidance includes broad phrases such as "用Ahrefs" and "Ahrefs说," plus a wide topical trigger of "关键词研究/外链建设的具体方法". Although line 3 says the material is not used by default, the file does not clearly define scope boundaries or negative examples, so the skill could be invoked in unintended contexts whenever Ahrefs is mentioned.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language metadata specifies 'Language: en,' which imposes a fixed language/locale. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a language policy violation.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This plain-text file instructs the user to "check the description to continue on with the course" without specifying a precise command, trigger phrase, or constrained context. In a skill corpus, this kind of broad natural-language continuation cue can overlap with common user speech and does not define when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The text explicitly says to exclude pages in other languages because the content and outreach pitch would be in English. This is a natural-language locale restriction presented as a default rule, with no user opt-in or region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This is a true positive: the content explicitly discusses offering a product sample or trial with stated monetary value and then asking for consideration to be included in an article, which functionally encourages a value exchange tied to backlink acquisition. Even though the speaker notes this is against Google's terms and frames it as ethical, the guidance still operationalizes a pay-for-placement/link scheme that can enable deceptive SEO practices, search engine penalties, and reputational harm.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The text explicitly instructs the user to exclude pages in other languages because the content and outreach pitch are in English. While this is likely practical SEO/outreach guidance rather than malicious behavior, it encodes language-based exclusion without any qualification, opt-in, or business-need framing, which can normalize discriminatory filtering in automated prospect vetting workflows.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The content gives instructions for using search operators to discover exposed PDFs and potentially sensitive personal information such as employee salaries and home addresses. Even though framed as privacy awareness and defensive auditing, it operationalizes reconnaissance techniques that could be repurposed to identify exposed sensitive documents on third-party domains.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document title is presented in Simplified Chinese ("电商 SEO 入门"), while the body is largely English content copied from Google Search Central. This mixed-language presentation imposes a locale/language choice without offering user selection or explaining why this file is specifically localized, which matches the policy concern for forced language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file presents the guide title in Chinese and the document content is effectively localized to Chinese without any instruction that language choice is optional for the user. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references-google/ecommerce-url-structure.md (reported line 339)May include surrounding context.

md
* For products with unique URLs per variant, include the canonical product URL on all variant pages using a `<link rel="canonical">` tag. For more information, see [the `canonical_link` property of Google Merchant Center](https://support.google.com/merchants/answer/9340054). 
  * Include links directly on the pages using `<a href>` tags; don't use JavaScript to navigate between pages. Googlebot might not detect navigation from JavaScript code. For more information about how Google processes JavaScript, see [Understand the JavaScript SEO basics](/search/docs/guides/javascript-seo-basics). 
  * Include meaningful text between `<a href>` and `</a>` tags where possible, such as the title of the product being linked to. Don't use generic phrases such as "click here". 
  * Avoid linking to, or at least indexing, pages without useful content. If a category has no items, use a [`noindex` robots `meta` tag](/search/docs/crawling-indexing/robots-meta-tag#noindex). If your site detects that a category has become empty and automatically removes the category from on-site search and browse, consider returning a `404 (not found)` HTTP status code for the page. 

Additional resources  Want to learn more? Check out the following resources:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file title and surrounding content are presented in Chinese, while the document does not state that the locale is user-selectable or that the skill is intentionally restricted to Chinese-speaking users. Per the policy, forcing a specific language without opt-in is a natural-language locale violation unless clearly documented and justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references-google/fix-search-javascript.md (reported line 430)May include surrounding context.

md
2. Make sure to prevent [`soft 404` errors](/search/docs/crawling-indexing/troubleshoot-crawling-errors#soft-404-errors). In a single-page application (SPA), this can be especially difficult. To prevent error pages from being indexed, you can use one or both of the following strategies: 
     * Redirect to a URL where the server responds with a `404` status code. 
        
                fetch(`https://api.kitten.club/cats/${id}`)
         .then(res => res.json())
         .then((cat) => {
           if (!cat.exists) {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references-google/fix-search-javascript.md (reported line 441)May include surrounding context.

md
2. Make sure to prevent [`soft 404` errors](/search/docs/crawling-indexing/troubleshoot-crawling-errors#soft-404-errors). In a single-page application (SPA), this can be especially difficult. To prevent error pages from being indexed, you can use one or both of the following strategies: 
     * Redirect to a URL where the server responds with a `404` status code. 
        
                fetch(`https://api.kitten.club/cats/${id}`)
         .then(res => res.json())
         .then((cat) => {
           if (!cat.exists) {

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The document title is presented in Chinese while the body content later appears in English, and the page also lists many available language options. This creates a natural-language locale inconsistency that can violate a language-choice policy because the file itself does not state that Chinese is required or user-selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file appears to be a localized skill/document variant, but it does not state that Chinese is optional, user-selected, or required for a region-specific purpose. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The title is presented in Chinese ('SafeSearch 与成人内容指南') even though the document body and navigation contain extensive English text, and the file does not explain that the Chinese localization is intentional or region-specific. This creates a language/locale policy concern because the skill content appears to impose a language choice without user opt-in.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references-google/cloaking.md (reported line 599)May include surrounding context.

md
Even when SafeSearch is off or set to blur, Google's ranking and language understanding systems work to prevent unwanted exposure to sexually explicit and graphic violent content. Using query understanding algorithms, Google Search is designed to detect whether searches are seeking out explicit content, helping reduce the chances of encountering unwanted explicit search results. 

Regardless of your SafeSearch setting, Google removes pages that violate our [content policies](https://support.google.com/websearch/answer/10622781) (such as child sexual abuse material). We also remove pages upon user request for [personal information removal](https://support.google.com/websearch/troubleshooter/3111061) (for example content involving [explicit personal imagery created or shared without consent](https://support.google.com/websearch/answer/6302812), or [explicit non-consensual fake content](https://support.google.com/websearch/answer/9116649)). 

### How Google handles sites with a significant amount of removals of violative sexually explicit content

Static analysis

No suspicious patterns detected.