Security audit

SEO Article Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This SEO writing skill is mostly purpose-aligned, but it tells the agent to commit and push generated blog content to the main branch without a clear confirmation step.

Install only if you are comfortable with an SEO workflow that sends keywords to DataForSEO and Google Suggest, uses DataForSEO credentials from environment variables, writes article and image files, and may commit and push to your repository. Treat Git commit and push steps as manual review points, prefer a draft branch or pull request, and avoid using confidential campaign terms unless third-party lookup is acceptable.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/research-keyword.sh:19
Finding: DataForSEO Credentials Exposed Through Process Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/research-keyword.sh:8
Finding: Unvalidated Input Embedded in Authenticated JSON Requests and Google Suggest URL
Content: View full analysis
/dev/null | ``` ### Technical Analysis `KEYWORD`, `LANG`, and `LOCATION` originate from positional command-line arguments and are inserted directly into JSON strings. They are not encoded by a JSON serializer: - Quotes, backslashes, control characters, and JSON delimiters in `KEYWORD` or `LANG` can invalidate or alter the request structure. - `LOCATION` is inserted as an unquoted JSON value and is not verified as numeric, increasing the potential for structural manipulation. - The authenticated DataForSEO requests are made with the user's credentials, so manipulated request data can consume the user's account quota. - The Google Suggest request replaces spaces with plus signs but does not perform complete URL encoding. Reserved characters such as `&`, `#`, `=`, and `?` can alter query interpretation. The shell does not recursively reinterpret metacharacters produced by ordinary parameter expansion, so the reviewed code does not establish di ...[truncated 1135 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:302
Finding: Generated Content Is Pushed Directly to the Main Branch Without a Confirmation Boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad end-to-end SEO content pipeline covering research through article creation, image generation, fact-checking, humanization, assembly, and translation. The supplied code chunk only implements a narrow keyword research utility: it validates inputs and credentials, calls DataForSEO APIs for search volume and related keywords, and fetches Google Suggest suggestions. While keyword research is one component of the declared pipeline, the code shown does not perform the other major advertised capabilities. This is a material description-to-behavior mismatch because the actual code’s primary purpose is limited keyword research rather than full article production.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill clearly instructs use of shell capabilities (scripts/research-keyword.sh, cwebp, ffmpeg, git) but does not declare an explicit tool scope or allowed-tools boundary. That creates an authorization gap where an agent may execute filesystem and command operations beyond what a user would reasonably expect from a content-writing skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says the skill generates SEO content, but the body also stages files into a repository and performs version-control operations. Omitting write-and-publish behavior is dangerous because users may invoke what looks like a drafting tool and unexpectedly get local repo changes or remote publication actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invocation wording is broad enough to match many ordinary writing requests, increasing the chance the skill is triggered in situations where the user only wanted brainstorming or drafting help. Because the skill also performs shell, file-write, image, and git actions, overbroad triggering materially increases the risk of unintended side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions direct file creation, image copying, git commit, and git push without any required user-facing warning or approval step. This is dangerous because the skill can make persistent local changes and publish them remotely as part of a routine content request, violating user expectations and change-control practices.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Including git push origin main gives the skill the ability to publish content directly to a remote branch, potentially altering production content or triggering deployment pipelines. In a content-generation context, automatic remote push is higher risk because it crosses from drafting assistance into unilateral external side effects.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This code transmits the supplied keyword and contextual metadata to DataForSEO over the network. In this skill, external transmission is functionally expected, but it still constitutes a real data egress path that can leak sensitive inputs if users assume processing is local.
Content: Scanner excerpt · scripts/research-keyword.sh (reported line 32)May include surrounding context.
sh
# 1. Search volume echo "--- Search Volume ---" curl -s -X POST "https://api.dataforseo.com/v3/keywords_data/google_ads/search_volume/live" \ -u "$DFORSEO_LOGIN:$DFORSEO_PASS" \ -H "Content-Type: application/json" \ -d "[{\"keywords\":[\"$KEYWORD\"],\"language_code\":\"$LANG\",\"location_code\":$LOCATION}]" | \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This code transmits the supplied keyword and contextual metadata to DataForSEO over the network. In this skill, external transmission is functionally expected, but it still constitutes a real data egress path that can leak sensitive inputs if users assume processing is local.
Content: Scanner excerpt · scripts/research-keyword.sh (reported line 32)May include surrounding context.
sh
# 1. Search volume echo "--- Search Volume ---" curl -s -X POST "https://api.dataforseo.com/v3/keywords_data/google_ads/search_volume/live" \ -u "$DFORSEO_LOGIN:$DFORSEO_PASS" \ -H "Content-Type: application/json" \ -d "[{\"keywords\":[\"$KEYWORD\"],\"language_code\":\"$LANG\",\"location_code\":$LOCATION}]" | \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This second API call sends the keyword to DataForSEO again for related-keyword expansion, increasing external exposure of user input. The behavior aligns with the stated SEO purpose, but it remains a real privacy and data-governance concern if not transparently communicated.
Content: Scanner excerpt · scripts/research-keyword.sh (reported line 53)May include surrounding context.
sh
# 2. Related keywords echo "--- Related Keywords (top 15 by volume) ---" curl -s -X POST "https://api.dataforseo.com/v3/keywords_data/google_ads/keywords_for_keywords/live" \ -u "$DFORSEO_LOGIN:$DFORSEO_PASS" \ -H "Content-Type: application/json" \ -d "[{\"keywords\":[\"$KEYWORD\"],\"language_code\":\"$LANG\",\"location_code\":$LOCATION,\"sort_by\":\"search_volume\",\"limit\":15}]" | \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This second API call sends the keyword to DataForSEO again for related-keyword expansion, increasing external exposure of user input. The behavior aligns with the stated SEO purpose, but it remains a real privacy and data-governance concern if not transparently communicated.
Content: Scanner excerpt · scripts/research-keyword.sh (reported line 53)May include surrounding context.
sh
# 2. Related keywords echo "--- Related Keywords (top 15 by volume) ---" curl -s -X POST "https://api.dataforseo.com/v3/keywords_data/google_ads/keywords_for_keywords/live" \ -u "$DFORSEO_LOGIN:$DFORSEO_PASS" \ -H "Content-Type: application/json" \ -d "[{\"keywords\":[\"$KEYWORD\"],\"language_code\":\"$LANG\",\"location_code\":$LOCATION,\"sort_by\":\"search_volume\",\"limit\":15}]" | \

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest describes an SEO article pipeline driven by a target keyword, but does not indicate that the skill depends on host-stored credentials or secret access. Reading DATAFORSEO_LOGIN and DATAFORSEO_PASSWORD introduces a credential-handling capability that goes beyond the user-facing content-creation purpose, even though it is used for legitimate keyword research.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script sends the user-supplied keyword to a third-party SEO API without any explicit notice or consent gate. While keyword research inherently requires external lookup, user inputs may contain sensitive business plans, unpublished campaign terms, or client data, so silent transmission creates a privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script also sends the keyword to Google's suggestion endpoint without notifying the user. This expands third-party exposure beyond the primary SEO vendor, which is unnecessary from a privacy perspective unless clearly disclosed and justified.
Content: No source excerpt is available for this finding.