AI Search Visibility Review (ChatGPT, Claude, Perplexity) - SEOmatic

• Outcome: Review
• Latest audit: Oct 13, 2026 · 2:45 PM UTC
• Version: 1.0.2

Overview

The skill is coherent for SEOmatic AI-visibility management, but it can change persistent tracked-prompt settings without clearly requiring user approval for those account changes.

Install this only if you are comfortable letting the agent manage SEOmatic tracked prompts. For general reviews, ask it to report recommended prompt changes first and wait for your explicit approval before adding, deactivating, removing prompts, changing cadence, or running paid scans.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:39

Finding

External Prompt Configuration Can Be Modified Without Explicit User Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–42
Vulnerability Type: Unconfirmed modification of external account configuration
Risk Level: Medium

Relevant snippet:

markdown

3. **Tune the prompts**: add missing money questions with `visibility_manage` add (the
   buyer's words, not keywords - "best invoicing software for freelancers").
   Remove or deactivate stale ones (deactivate keeps history). Plan-capped:
   relay the upgrade path on a limit refusal.

Technical Analysis

The Skill can be invoked for a general AI-visibility review, but its workflow directs the agent to add, remove, or deactivate tracked prompts through the connected SEOmatic account. The instructions do not require the agent to present the proposed changes or obtain explicit user approval before invoking these mutating operations.

The Skill itself determines which prompts are “missing” or “stale.” Consequently, an initially read-oriented review can cross a trust boundary into modification of persistent external account configuration. Although the document imposes explicit consent requirements for daily cadence and fresh scans, no equivalent control is specified for prompt mutations.

This is a reachable authorization weakness rather than evidence of malicious intent.

Attack Path

1. A user invokes the Skill with a general request to review the brand's visibility in AI search.
2. The Skill reads stored scan results and existing tracked prompts.
3. Based on its own assessment, the agent classifies prompts as missing or stale.
4. Without presenting a change plan or requesting explicit approval, the agent calls visibility_manage to add, remove, or deactivate prompts.
5. The connected SEOmatic account retains these changes, affecting later scans and use of plan-limited resources.

Impact Assessment

Successful triggering allows changes to the tracked-prompt configuration within the connected SEOmat ...[truncated 359 chars]

Remediation

View remediation

Remediation Suggestions

Make review workflows read-only by default. Before any visibility_manage add, remove, deactivate, or cadence-changing operation:

1. Display the exact proposed changes and explain their effect on scan coverage, history, allowances, and cost.
2. Require explicit user confirmation for the specific mutation set.
3. Do not treat a generic review request as authorization to modify persistent account configuration.
4. Separate recommendation generation from execution so users can reject or edit individual changes.
5. Prefer deactivation over deletion when history must be retained, while still requiring confirmation.
6. If supported by the tool interface, enforce confirmation with a required approval parameter or equivalent technical gate rather than relying only on conversational guidance.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.