GEO Growth Orchestrator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.6

Overview

The skill is a coherent GEO content workflow with disclosed local artifact generation and no evidence of hidden publishing, credential theft, persistence, or destructive behavior.

Install only if you are comfortable with the skill generating full reports and local artifacts from the brand materials you provide. For sensitive client work, request summary-only output or use the scripts' no-print path where available, review generated files before sharing, and avoid the optional video npx/CDN workflow unless dependencies are pinned or run in a sandbox.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: videos/powermatrix-geo-not-volume/README.md:19

Finding

Unpinned npm Package Download and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: videos/powermatrix-geo-not-volume/README.md:19-25
Vulnerability Type: Uncontrolled third-party package execution
Risk Level: Medium

Vulnerable Code

markdown

The HyperFrames CLI could not be fetched in this environment because npm DNS resolution failed. Once the CLI is available, run from this folder:

~~~bash
npx hyperframes lint
npx hyperframes inspect --samples 15 --at 1.5,5.5,11.5,19,26.5
npx hyperframes preview --port 3017
npx hyperframes render --output powermatrix-geo-not-volume.mp4 --quality standard
~~~

Technical Analysis

The documented commands invoke hyperframes through npx without specifying an audited package version, requiring a lockfile, or verifying package integrity. If the package is not already installed locally, npx may retrieve it from the configured npm registry and immediately execute its command-line entry point.

This creates a supply-chain boundary in which the code executed by the user can change after the Skill has been reviewed. A compromised package release, package-name takeover, malicious registry configuration, or dependency compromise could introduce arbitrary installation or runtime code.

The HyperFrames rendering tool is supplementary to the included video asset and is not required for the Skill's core GEO audit and report-generation functionality. Consequently, automatic remote package retrieval exceeds the minimum privileges and dependency surface needed for the core workflow.

Attack Path

1. An attacker compromises the hyperframes npm package, one of its transitive dependencies, or the registry used by the victim.
2. A user follows the README instructions and runs an unversioned npx hyperframes command.
3. npx downloads the currently resolved package when no verified local installation is available.
4. npm installation hooks or the package's CLI entry point execute under the user's account.

...[truncated 777 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin HyperFrames to a reviewed exact version rather than invoking an unversioned package name.
2. Add an npm manifest and lockfile containing integrity metadata, and commit both to the project.
3. Install dependencies in a separate, explicit setup step and use npx --no-install hyperframes ... during rendering.
4. Disable lifecycle scripts during installation where compatible with the package, or review all required lifecycle scripts before allowing them.
5. Document the expected official package name, publisher, registry, version, and checksum.
6. Run the renderer in a restricted container or sandbox with no credentials, minimal filesystem mounts, and only necessary network access.
7. Keep the optional video-rendering dependency isolated from the core GEO workflow.

T08 · Insecure Dependencies

Warning

• Location: videos/powermatrix-geo-not-volume/index.html:39

Finding

Execution of CDN-Hosted JavaScript Without Subresource Integrity

Content

View full analysis

Vulnerability Details

File Location: videos/powermatrix-geo-not-volume/index.html:39
Vulnerability Type: Unverified remote JavaScript dependency
Risk Level: Medium

Vulnerable Code

html

<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>

Technical Analysis

The video composition loads and executes JavaScript directly from a third-party CDN. Although the dependency version is present in the URL, the script element does not include a Subresource Integrity hash. The browser therefore trusts whatever content is returned for that URL at load time.

If the CDN, package publication, DNS resolution path, or delivery account is compromised, modified JavaScript can execute in the page's browser context without any local integrity check. This is a remote payload execution boundary because the effective script body is not contained in the audited project.

This dependency is associated with an optional video composition rather than the core GEO audit and report-generation workflow. Loading remote executable code for local review unnecessarily expands the network and supply-chain attack surface.

Attack Path

1. An attacker compromises the CDN delivery path, the corresponding npm package artifact, or another trusted component used to serve the script.
2. A user opens index.html while network access is available.
3. The browser requests the GSAP script from cdn.jsdelivr.net.
4. Because no integrity value is specified, the browser accepts and executes the returned content.
5. The malicious script operates with the capabilities available to JavaScript in that page and browser context.

Impact Assessment

Exploitation could alter the video composition, inspect or manipulate page content, issue outbound requests, consume browser resources, and interact with browser-accessible state permitted by the page's origin and runtime configuration. If the page is hosted alongsi ...[truncated 406 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor a reviewed copy of GSAP within the project and reference the local file.
2. If CDN delivery must be retained, add a verified integrity attribute and crossorigin="anonymous" to the script element.
3. Pin the dependency through a lockfile and verify the vendored or downloaded artifact against an approved checksum.
4. Apply a restrictive Content Security Policy that permits scripts only from explicitly approved sources and disallows unnecessary dynamic execution.
5. Review the composition in an isolated browser profile without credentials or sensitive sessions.
6. Document that opening the composition may initiate a third-party network request.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (94)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad end-to-end GEO/AI visibility workflow covering analysis, audits, report generation, content task creation, QA, and retests. The supplied code only merges existing platform draft JSON inputs into a consolidated publish-plan file and adds default review metadata. While this loosely relates to the declared 'platform draft planning' area, it does not implement the primary advertised capabilities and is materially narrower in purpose. There is no evidence of AI visibility analysis, GEO diagnosis, report generation, or retest workflow logic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad operational workflow for GEO growth, audit, content generation, platform planning, reporting, and retesting. The code chunk only validates the structure and policy compliance of an existing workflow_state JSON document. While this fits as a narrow internal QA/supporting component of such a workflow, it does not itself implement the claimed end-to-end GEO workflow capabilities. The primary behavior is materially different and much narrower than the declared purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · runs/spanish_ham_demo/validation_result.md (reported line 15)May include surrounding context.

md

| Check | Status | Notes |
|---|---|---|
| Orchestrator contracts | passed | registry exists, relative paths start with `../`, routing and missing-output rules passed |
| Full report smoke test | passed | original `final_report.md` smoke test still passes |
| Spanish Ham demo run | passed | required directories, JSON files, client report, mock disclaimer and retest plan are present |

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This is a stronger expression of the same control failure: the rules explicitly state that routing never means auto-publishing, but the platform map later routes to publisher skills. In an agentic system, contradictory policy and implementation guidance is dangerous because automation may follow the executable mapping rather than the narrative safety rule, leading to unauthorized or premature publication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The changelog text specifies a required Chinese output artifact, including the exact phrasing “老板能看懂的3句话结论,” which indicates the skill is shaping outputs for a specific language/locale. There is no indication here that users can choose another language or that the locale restriction is optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly instructs the agent to print the complete final report into the chat window by default and to save/display raw model answers. In this workflow, reports are built from enterprise materials, FAQs, cases, contacts, compliance constraints, and model probe outputs, so default full echoing increases the chance of disclosing sensitive customer data, proprietary business information, or third-party content into the conversation or logs beyond the minimum necessary output.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill references local scripts, schemas, templates, and saving artifacts, which implies file and possibly shell execution behavior, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where a runtime may grant broader capabilities than a reviewer or user expects, increasing the risk of unintended file access or command execution if the skill is invoked in a permissive environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction says to mark unknown facts as 待确认, which forces a specific language/locale in outputs. This is a natural-language policy issue because the skill does not offer the user a language choice or explain that Chinese-only output is required for a justified regional context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill file is written in Chinese and presents deliverables, publishing guidance, and execution steps only in that language, with no indication that the user can choose another language or that the skill is restricted to a Chinese-language audience. Under the policy, a language constraint should be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file’s natural-language content, target audiences, keywords, tone, and compliance constraints are all specified exclusively in Chinese, indicating the skill is constrained to a specific language/locale. There is no accompanying opt-in, user choice, or explicit justification that this is a region-specific skill, so this can violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JSON contains natural-language fields and model outputs exclusively in Chinese, but the file provides no opt-in, fallback, or justification that the skill is intended only for Chinese-language users. Under the language/locale policy, forcing a single language without user choice can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents all instructions, examples, and outputs exclusively in Chinese, which can impose a fixed language/locale on users without opt-in. The policy for natural-language violations applies to all file types, and there is no indication that the skill offers a language choice or that the Chinese-only scope is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The role and instructions are written to require operation in Chinese, and the prompt does not offer any user opt-in or alternative language/locale handling. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The prompt defines the role and all instructions in Chinese, effectively constraining the skill to a specific language/locale. The file does not indicate that the user can opt into another language or that the restriction is required for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The role and instructions are written entirely in Chinese and define the editor persona and output format in Chinese, which implies a fixed language/locale for operation. There is no indication that the user can choose another language or that the Chinese-only constraint is required for a region-specific compliance or business reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt defines the role and instructions entirely in Chinese, effectively constraining the skill to a specific language/locale. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the regional constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The role and task instructions are written entirely in Chinese and target Chinese platforms, which effectively constrains the skill to a specific language/locale. The file does not offer an opt-in choice of language or explain that this is a region-specific skill with an explicit documented locale limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt instructions are entirely in Chinese and prescribe the role, goals, and writing style in that language, which effectively forces a specific language/locale. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructions are written as a direct role specification in Chinese and describe the planner's behavior entirely in that language, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The prompt is written entirely in Chinese and instructs the agent to act in that language/context, but it does not offer any user choice of language or explain a justified region-specific constraint. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt defines the role and operating instructions entirely in Chinese, effectively constraining the skill's language/locale behavior. Under the policy, forcing a specific language without explicit user choice or a clearly justified region-specific scope is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s role, output template, and rewrite rules are entirely specified in Chinese, which effectively constrains the skill to a single language. The policy only permits this when the skill offers a language/locale choice or clearly documents a justified region-specific constraint, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt defines the role and all operating instructions exclusively in Chinese, which imposes a specific language/locale on the skill. The file does not indicate that this is optional, user-selected, or justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The role, task, and tone instructions are entirely specified in Chinese and direct the agent to produce reports in that style, but the prompt does not provide any user opt-in or alternative language option. This creates a natural-language policy concern because it effectively forces a specific language/locale for outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'Reporting Language' section instructs the skill to use Chinese example phrasings, which functions as a language constraint in the file's natural-language guidance. The file does not offer a user language choice or explicitly justify the locale restriction as region-specific policy, so it appears to force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.