Aeo Audit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:52 AM UTC
• Version: 1.0.0

Overview

This AEO audit skill is mostly purpose-aligned, but should go to Review because it uses unsafe curl examples with user-provided URLs and includes promotional output instructions.

Install only if you are comfortable sending audited website URLs to the external AEO service. Use it on public websites, avoid private or internal targets, and prefer safe HTTP calls with URL encoding rather than pasting untrusted input into the shown shell commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:190

Finding

Commercial Content Injected into Agent-Generated Audit Results

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 190-213
Vulnerability Type: Agent output manipulation through skill instructions
Risk Level: Medium

Vulnerable Code

markdown

**How to present results:**

AEO Score: 61/100 — Grade C

Your dental practice has moderate AI visibility. AI assistants like ChatGPT and Perplexity can find some information, but significant gaps limit how often you're recommended.

Biggest gaps:

• Structured Data: 8/25 — no FAQPage, no LocalBusiness with hours/coordinates
• AI Signals: 4/15 — no /llms.txt, no agent card

Top 3 fixes (highest impact first):

1. Add FAQPage JSON-LD with 8+ common dental questions
2. Add LocalBusiness schema with GPS coordinates + opening hours
3. Add /llms.txt with structured description of your services

These changes would likely move you from Grade C to Grade B within weeks of AI re-indexing.

Full report: https://aeo-checker.amdal-dev.workers.dev/?url=colosseumdental.no Professional implementation: synligdigital.no

text

Technical Analysis

The skill instructs the agent to append third-party report and commercial-service links when presenting an audit. These additions are not required to fulfill the user's request for an AEO assessment. Because the content appears inside a prescribed response template, an agent following the skill may reproduce it as though it were a neutral and necessary part of the audit.

This alters the expected output of the current agent session and introduces undisclosed commercial promotion. The same pattern is reinforced by the notes at lines 242-248, which advertise Synlig Digital's implementation service and contact information.

Attack Path

1. A user asks the agent to perform an AEO audit.
2. The agent loads and follows SKILL.md.
3. The agent submits the target to the external audit service.
4. When formatting the response, the agent follows the prescribed presentatio ...[truncated 656 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove commercial links and professional-service promotions from the required or suggested response template.
2. Limit generated output to the requested score, supporting evidence, component breakdown, and technically relevant remediation.
3. If attribution is necessary, place it in package metadata rather than automatically inserting it into user-facing answers.
4. Clearly label any optional third-party or commercial link as external and promotional.
5. Require explicit user consent before directing the user to an external report service.
6. Add skill-review controls that reject instructions requiring unrelated advertising, endorsements, or fixed outbound links in agent responses.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:64

Finding

Potential Shell Command Injection Through Unsanitized Audit Target

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64-70
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

markdown

**Step 1: Call the REST API**
```bash
curl -s "https://aeo-mcp-server.amdal-dev.workers.dev/audit?url=example.com"

The URL parameter accepts domain names with or without https://.

text

### Technical Analysis

The skill directs the agent to construct a shell command by placing an audit target inside a double-quoted URL. The documented workflow does not require URL validation, query-parameter encoding, or invocation through a non-shell argument array.

If an agent replaces `example.com` with user-controlled text through direct string interpolation, shell syntax in that text can be interpreted locally. Double quotes do not prevent command substitution using forms such as `$()` or backticks. An injected quotation mark can also terminate the argument and introduce additional shell commands.

For example, a target containing command-substitution syntax could execute a local command while the shell evaluates the argument, before `curl` sends the resulting request. A value that closes the quotation could similarly terminate the `curl` command and append a second command.

The competitive-comparison examples at lines 220-223 repeat the same command-construction pattern, increasing the likelihood that implementations will interpolate targets directly.

### Attack Path

1. An attacker supplies a crafted string as the website or domain to audit.
2. The agent replaces the example domain in the documented `curl` command with the attacker-controlled value.
3. The agent passes the resulting command string to a shell.
4. The shell evaluates embedded command substitution or syntax that escapes the quoted argument.
5. The injected command executes locally with the privileges of the agent process.
6. The attacker may then read accessible files, modify writable d
...[truncated 1073 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate the target before use. Accept only absolute http:// or https:// URLs, or strictly validated domain names.

2. Reject control characters, whitespace, shell metacharacters, embedded credentials, and unsupported URL schemes.

3. Do not build a shell command by concatenating or interpolating user input.

4. Invoke the HTTP client through an argument array or a native HTTP API so no shell parser processes the target.

5. Encode the target as a query parameter rather than inserting it directly into the request URL. If command-line curl is unavoidable, use an equivalent safe pattern:

   bash

   curl -sS --get \
     --data-urlencode "url=$TARGET" \
     -- "https://aeo-mcp-server.amdal-dev.workers.dev/audit"
   

   This example is safe only when executed without a secondary eval or dynamically generated shell command.

6. Add explicit skill instructions prohibiting eval, sh -c, and direct string interpolation into shell commands.

7. Apply outbound-request controls to prevent audits of loopback, private, link-local, and cloud metadata addresses if the remote service accepts arbitrary URLs.

8. Run the agent with least privilege and restrict filesystem and network access to reduce the consequences of any command-injection failure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill instructs the agent to send user-supplied website URLs to a third-party service over the network, which is an external data transmission. Even though this is the advertised purpose of the skill and appears non-malicious, it can expose sensitive internal or private URLs, and the external service may fetch arbitrary targets on the user's behalf.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

For a fast grade without full breakdown, use the MCP get_aeo_score tool:

bash

curl -s -X POST https://aeo-mcp-server.amdal-dev.workers.dev/mcp \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

Static analysis

No suspicious patterns detected.