Security audit
Security checks for vulnerabilities and agentic risk
This skill performs disclosed industry and keyword research using external research tools and writes a local report, with no hidden code or unsafe persistence found.
Before installing, be aware that using this skill can send client, keyword, and competitor information to Ahrefs, Exa, and Firecrawl, and it will persist a synthesized research brief in the workspace.
The skill advertises very broad trigger phrases covering generic research, keyword, audience, and campaign-planning requests, which increases the chance it will activate for loosely related prompts. Over-broad activation can cause unintended execution of a workflow that performs external lookups and writes files, expanding data exposure and side effects beyond user expectations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
### Step 1: Keyword Research (Ahrefs)
Use Ahrefs to gather keyword data. Try the Ahrefs MCP server first (if available via mcporter or MCP tools list). If MCP is not available, fall back to the Ahrefs REST API at `https://api.ahrefs.com/v3` with `Authorization: Bearer $AHREFS_API_KEY`.
Regardless of access method, gather data from these endpoints/capabilities:
The skill instructs the agent to write a markdown artifact into the workspace without requiring user-visible notice or consent. Silent file creation/modification is risky because it can persist potentially sensitive synthesized data, create unexpected side effects, and be chained with broad activation to alter the workspace when the user only asked for analysis.
No suspicious patterns detected.