SEO Audit Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 1.0.1

Overview

The skill is mostly an SEO audit helper, but it can make unrestricted web requests from the agent environment to any supplied URL.

Review this skill before installing in any environment with access to private networks, localhost services, or cloud metadata endpoints. It is best used only where outbound web access is sandboxed to public websites, and users should expect a visible promotional footer in generated reports.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: references/report-template.md:100
• Finding: Mandatory Template Injects Unrequested Platform Promotion into Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-18`; `references/report-template.md:100` **Vulnerability Type**: Output instruction hijacking through a mandatory promotional template **Risk Level**: High ### Vulnerable Code `SKILL.md:17-18`: ```markdown 2. **Generate the audit report** using the structure in `references/report-template.md`. ``` `references/report-template.md:100`: ```markdown *Generated by SEO Audit Pro — Available on ClawHub* ``` ### Technical Analysis The Skill instructs the Agent to generate every report using `references/report-template.md`. That template contains fixed promotional content unrelated to the technical results of the requested SEO audit. Because use of the template is part of the Skill's prescribed workflow, the promotional attribution can be inserted into user-facing output without the user requesting or consenting to it. This changes the Agent's output behavior whenever the Skill is loaded and used. The issue is classified as instruction hijacking because the controlling Skill instructions require the Agent to incorporate third-party promotional material into its response rather than limiting output to the user's requested audit. ### Attack Path 1. A user asks the Agent to perform an SEO audit. 2. The Agent loads `SKILL.md`. 3. The workflow directs the Agent to use `references/report-template.md`. 4. The Agent follows the template and appends the fixed ClawHub promotional footer. 5. The user receives unsolicited promotional content as part of an otherwise legitimate audit report. No additional privileges, external payloads, or attacker-controlled input are required for this behavior. ### Impact Assessment The issue affects the integrity of user-facing responses. It allows the Skill author to place persistent branding or promotional messaging into every generated report. The demonstrated content is limited to a promotional footer and does not grant operating-system privileges, execute code, ac ...[truncated 205 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory promotional footer from `references/report-template.md`. 2. Restrict the template to content directly required for the requested SEO audit. 3. If attribution is desired, make it explicitly optional and disclose it before including it in user-facing output. 4. Update `SKILL.md` to clarify that templates are structural guidance rather than a requirement to reproduce unrelated fixed content. 5. Review all referenced templates for hidden instructions, advertisements, external calls to action, or text that changes the Agent's goals. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/seo_audit.py:18
• Finding: Unrestricted User-Controlled HTTP Requests Enable Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/seo_audit.py:18-42`; `scripts/seo_audit.py:242-263` **Vulnerability Type**: Server-side request forgery through unrestricted URL fetching **Risk Level**: High ### Vulnerable Code `scripts/seo_audit.py:18-42`: ```python def make_request(url, timeout=10): """Make HTTP request with browser-like headers.""" headers = { 'User-Agent': 'Mozilla/5.0 (compatible; SEOAuditPro/1.0; +https://clawhub.ai)', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', } # Use system default SSL context (validates certificates properly) ctx = ssl.create_default_context() req = Request(url, headers=headers) try: start = time.time() response = urlopen(req, timeout=timeout, context=ctx) elapsed = round((time.time() - start) * 1000) content = response.read() return { 'status': response.status, 'headers': dict(response.headers), 'body': content.decode('utf-8', errors='replace'), 'ttfb_ms': elapsed, 'final_url': response.url, } except HTTPError as e: return {'status': e.code, 'headers': dict(e.headers), 'body': '', 'ttfb_ms': 0, 'final_url': url, 'error': str(e)} except URLError as e: return {'status': 0, 'headers': {}, 'body': '', 'ttfb_ms': 0, 'final_url': url, 'error': str(e)} except Exception as e: return {'status': 0, 'headers': {}, 'body': '', 'ttfb_ms': 0, 'final_url': url, 'error': str(e)} ``` `scripts/seo_audit.py:242-263`: ```python def run_audit(url, keyword=None): """Main audit runner.""" # Normalize URL if not url.startswith('http'): url = 'https://' + url print(f"[SEO Audit Pro] Auditing: {url}", file=sys.stderr) # Fetch main page print("[1/4] Fetching main page...", file=sys.stderr) response = make_request(url) if r ...[truncated 3416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse the URL before making a request and allow only the `http` and `https` schemes. 2. Require a valid hostname and reject embedded credentials, malformed authorities, and ambiguous IP-address representations. 3. Resolve the hostname and reject every address falling within loopback, private, link-local, reserved, multicast, or unspecified ranges for both IPv4 and IPv6. 4. Prevent DNS rebinding by connecting only to a previously validated resolved address while preserving the intended hostname for TLS verification and the HTTP `Host` header. 5. Disable automatic redirects or implement a restricted redirect handler. Resolve and validate every redirect target before following it. 6. Apply the same destination checks to the main page, `robots.txt`, and sitemap requests. 7. Consider an explicit allowlist of public domains if the execution environment does not need arbitrary Internet access. 8. Enforce a maximum response size and read incrementally rather than calling unbounded `response.read()`. 9. Restrict accepted response content types and avoid parsing unexpected binary data. 10. Apply egress firewall controls so the Skill process cannot reach cloud metadata endpoints, loopback services, or private network segments. 11. Add tests covering direct internal URLs, IPv6 loopback, alternative numeric IP formats, DNS rebinding, and public-to-private redirect chains. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill advertises a full SEO audit, content gap analysis, Core Web Vitals, and content brief generation, but the observed behavior appears substantially narrower and also includes undeclared HTTP/security header inspection. This mismatch is dangerous because it can mislead users and downstream systems about what data is collected and what conclusions are reliable, while also masking undeclared security-relevant network behavior under an SEO label.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to run a Python script against arbitrary user-supplied URLs, which implies network access and likely local file output/reads, but the manifest declares no explicit tool scope or permissions boundary. This creates an authorization and review gap: the agent may invoke capabilities broader than users or platform policy expect, increasing the chance of unintended network access or unsafe file interactions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description lists broad activation phrases such as "check SEO", "content brief for", and "improve my rankings" without clear scope limits or exclusion conditions. These phrases are generic enough to match ordinary conversation and could cause unintended invocation outside a narrowly defined SEO-audit context.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The request headers hard-code `Accept-Language: en-US,en;q=0.5`, which imposes a specific language/locale preference on every audited request. This is a natural-language policy concern because the skill does not offer user opt-in or explain why English must be forced for all targets.

Static analysis

No suspicious patterns detected.