Security checks for vulnerabilities and agentic risk
Overview
This SEO audit skill is a plain Markdown guide whose network/API examples are relevant to SEO work, with some operational cautions around third-party URL sharing and unpinned Lighthouse execution.
This skill is reasonable to install for SEO work. Before running its examples, use public or approved URLs, avoid pasting real API tokens directly into shell history, and prefer a pinned or already-installed Lighthouse version such as a lockfile-managed local binary or `npx --no-install`.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:51
Finding
Unpinned npm Package Execution Through npx
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, line 51 Vulnerability Type: Unpinned third-party dependency execution Risk Level: Medium
Vulnerable Code
bash
# Using lighthouse locally
npx lighthouse https://example.com --view
Technical Analysis
The documented command invokes lighthouse through npx without specifying a reviewed version or requiring an existing local installation. If the package is not already installed, npx may resolve, download, and execute package content from the configured npm registry.
Because neither a version nor an integrity-protected lockfile is specified, the executable dependency can change after the Skill has been reviewed. The command therefore creates a supply-chain risk: compromise of the package, its registry account, its transitive dependencies, or the configured registry could cause arbitrary package or lifecycle code to execute locally.
Attack Path
An attacker compromises a relevant package release, package-maintainer account, transitive dependency, or npm registry path.
The user or agent follows the Skill's Page Speed Analysis instructions.
npx finds no trusted local Lighthouse installation and resolves the unpinned package from the configured registry.
npm downloads the current package and its dependency graph.
Package or lifecycle code executes with the permissions and environment of the invoking user.
Malicious code can access resources available to that user before or while the expected Lighthouse operation runs.
This path depends on compromise or manipulation of the external package supply chain; the audited Skill does not itself contain a malicious payload.
Impact Assessment
Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The accessible scope may include project files, user-readable files, environment variables, network resources, and credentials available to that process. The command does not
...[truncated 168 chars]
Remediation
View remediation
Remediation Suggestions
Add Lighthouse as an exact, reviewed development dependency rather than resolving it dynamically:
bash
Enforce package integrity, use a trusted registry configuration, restrict lifecycle scripts where operationally feasible, and run the audit in a least-privileged or isolated environment.
Periodically reassess and deliberately update the pinned version after dependency and security review.
These examples send target URLs and related page information to external services such as Google PageSpeed and Mobile-Friendly Test without warning the user that site data will be transmitted off-platform. In enterprise or confidential environments, even sharing internal URLs or audit targets can disclose sensitive information or violate policy.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding
The skill instructs users to run npx lighthouse without pinning a specific package version. This can pull and execute whatever version is current at runtime, increasing supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding
This command explicitly posts a user-supplied URL to Google's Mobile-Friendly Test API, causing external transmission of potentially sensitive target information. Without a warning, users may unintentionally disclose internal domains, staging systems, or client assets to a third party.
Content
Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
bash
# Google's Mobile-Friendly Test API
curl "https://searchconsole.googleapis.com/v1/urlTestingTools/mobileFriendlyTest:run?key=YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com"}'
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The structured data validation instructions use a Google API with an authorization bearer token but do not warn about credential sensitivity or external data disclosure. This can lead users to paste real tokens into shell history or send proprietary URLs and page metadata to a third party without informed consent.
