Find Seo Agency

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with finding SEO agencies, but it tells agents to source a local credential file as shell code before calling an external API.

Review before installing. Prefer using the ServiceGraph MCP server or a harness-injected `SERVICEGRAPH_API_KEY`; do not let the agent source `.env.local` as shell code. Confirm any paid unlock action before spending credits.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:76

Finding

Unsafe Shell Sourcing of Project-Local Environment File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76–81
Vulnerability Type: Unsafe configuration loading leading to arbitrary command execution
Risk Level: Medium

Vulnerable Code:

bash

1. **Try the call first** through a shell wrapper that sources `.env.local`:

   ```bash
   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )
   ```

Technical Analysis

The documented authentication flow executes .env.local with the shell dot command:

bash

. ./.env.local

Shell sourcing does not treat the file as passive key-value configuration. It evaluates its contents as shell code in the current subshell. Consequently, a malicious or compromised .env.local can contain command substitutions, function calls, redirections, or arbitrary commands that execute when the agent follows the documented procedure.

The use of set -a additionally exports every variable created or modified by .env.local to subsequent child processes. Only SERVICEGRAPH_API_KEY is required for the API request, so exporting all values from the file exceeds the minimum privileges and data exposure necessary for the Skill's functionality.

Attack Path

1. An attacker gains the ability to create or modify .env.local in the working directory, such as through a compromised repository, generated project artifact, or another process with workspace write access.
2. The attacker inserts executable shell content into the file. For example, the file could run a local command before assigning the expected API key.
3. The agent follows the Skill's instructed authentication recipe.
4. The shell evaluates .env.local rather than parsing it as data.
5. The attacker's commands execute with the same operating-system identity, filesystem access, environment access, and networ ...[truncated 1039 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not source .env.local or any project-controlled configuration file as shell code.
2. Prefer an environment variable injected directly by the execution harness:

   bash

   test -n "${SERVICEGRAPH_API_KEY:-}" || {
     printf '%s\n' 'SERVICEGRAPH_API_KEY is not configured' >&2
     exit 1
   }
   
   curl --fail-with-body --silent --show-error \
     -H "Authorization: Bearer ${SERVICEGRAPH_API_KEY}" \
     'https://api.servicegraph.co/v1/datasets/pro_services/fields'
   

3. If .env.local support is essential, parse only an exact SERVICEGRAPH_API_KEY assignment with a dedicated dotenv parser that does not evaluate shell syntax. Reject duplicate keys, malformed input, command substitutions, and unexpected entries.
4. Pass only SERVICEGRAPH_API_KEY to the API client rather than enabling automatic export for every variable with set -a.
5. Resolve and validate the intended configuration path explicitly. Verify appropriate ownership and restrictive permissions before reading it.
6. Continue sending the bearer credential only to the declared HTTPS API endpoint, and ensure verbose HTTP tracing or logs do not record the Authorization header.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to load .env.local, which is a credential source, into the shell environment. Even though it says not to put the token in LLM context, this still directs the agent toward secret retrieval from local storage, which is dangerous in adversarial or over-permissioned execution environments because it normalizes secret access and subsequent use.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

1. Try the call first through a shell wrapper that sources .env.local:

   bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )
   

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to source .env.local and immediately use the loaded credential in a shell command, but it does not require explicit user confirmation before accessing local secrets. In an agent setting, this creates a real credential-access path from the local environment to an external API call, increasing the chance of unintended secret use or misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The command sends an authenticated request to an external service, which means locally held credentials are used to initiate data transmission off-host. While calling the ServiceGraph API is the intended function of the skill, the risk is real because the transmission occurs after sourcing a local secret and could happen without sufficiently explicit approval in some agent harnesses.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

2. On 401 prompt the user: