Security audit

SEO Audit Suite

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real SEO/GEO audit skill, but it needs Review because crafted inputs can execute code or write outside the intended workspace, and external API/credential use is under-scoped.

Do not run this skill on untrusted URLs, internal services, staging hosts, or client-confidential keyword sets until the input handling is fixed. Use a sandboxed environment, restrict network egress, use dedicated low-privilege API keys, avoid Owner or Full service-account permissions, and review or delete the persisted audit workspace after use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/technical-audit.sh:14
Finding: Arbitrary Python Code Execution Through URL Interpolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/audit-page.sh:39
Finding: Server-Side Request Forgery Through Unrestricted Audit URLs
Content: View full analysis
1 else "" if not url: url = os.environ["AUDIT_URL"] headers = {"User-Agent": "ReighlanSEOBot/1.0"} try: resp = requests.get(url, headers=headers, timeout=15, allow_redirects=True) except Exception as e: print(f"❌ Failed to fetch {url}: {e}") sys.exit(1) ``` Related unrestricted requests appear in: - `scripts/seo_auditor.py:20-27` - `scripts/site_crawler.py:52` - `scripts/audit-technical.sh:27-36` - `scripts/audit-technical.sh:86-90` - `scripts/technical-audit.sh:30` - `scripts/geo-audit.sh` through `seo_auditor.fetch_page` ### Technical Analysis The Skill accepts an arbitrary URL and sends a request without validating: - The scheme. - The resolved IP address. - Whether the destination is loopback, private, link-local, reserved, or multicast. - The destination port. - Redirect destinations. - DNS changes between validation and connection. Because redirects are enabled, a URL that initially resolves to a public host can redirect the request to a private address. The technical audit additionally reads a `Sitemap:` URL from remote `robots.txt` content and requests it without constraining it to the audited public host. Public-site SEO analysis requires outbound access to the requested site, but it does not require unrestricted access to localhost, private networks, cloud metadata services, or arbitrary internal ports. The current implementation therefore exceeds minimum necessary network privileges. ### Attack Path 1. An attacker supplies a URL pointing directly to an internal destination, or controls a public page that redirects to one. 2. The Skill accepts the URL without checking the resolved address. 3. `requests.get()` sends the request from the Agent host. 4. The destination receives a re ...[truncated 1028 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/track-keywords.sh:18
Finding: Workspace Path Traversal Through Unvalidated Site Identifiers
Content: View full analysis
--keywords \"kw1,kw2\" | --report"; exit 1; } BASE_DIR="${SEO_AUDIT_DIR:-$HOME/.openclaw/workspace/seo-audit}" KW_DIR="$BASE_DIR/sites/$SITE/keywords" mkdir -p "$KW_DIR" ``` Related unsafe path construction appears in: - `scripts/generate-report.sh:19-26` - `scripts/audit-page.sh:17-22` - `scripts/audit-geo.sh:9-14` - `scripts/audit-technical.sh:9-14` ### Technical Analysis `SITE` is accepted as an arbitrary string and directly inserted into a filesystem path. There is no hostname validation, path canonicalization, or verification that the resulting path remains below `BASE_DIR`. A value containing path separators or `..` components can escape the intended `sites` directory. Subsequent operations create directories, read tracking files, or write JSON output under the resolved path. Report generation has a similar issue because both `SITE` and `TYPE` become parts of directory and report filenames. It can therefore read audit data from an unintended directory or write a Markdown report outside the expected report naming boundary when suitable parent directories exist. ### Attack Path 1. An attacker supplies a crafted `--site` or `--type` value containing traversal components. 2. The script concatenates that value with the configured workspace path. 3. The operating system resolves the traversal components. 4. `mkdir`, Python file reads, or report/tracking writes operate on the unintended location. 5. Files accessible to the Skill account may be created, overwritten, or consumed as audit input. The source-code interpolation issue in these scripts can provide a more direct execution path, but path traversal remains independently exploitable in the filesystem construction. ### Im ...[truncated 583 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/audit-technical.sh:113
Finding: PageSpeed API Key Exposed in Request Query String
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:11
Finding: Unpinned Runtime Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code materially underdelivers relative to the declared description. Its actual purpose is narrowly a GEO audit for a single URL, not a comprehensive SEO/GEO toolkit. It does perform one declared area—GEO readiness evaluation for AI search engines—and saves a local report, but there is no evidence in this chunk of competitor analysis, keyword tracking, broad technical SEO auditing, PDF generation, or time-series monitoring. Resource access is broadly consistent with auditing a website (HTTP fetch of the target URL and local file write), and there are no suspicious unrelated capabilities. However, the declared description significantly overstates the functionality represented by this code chunk, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code does match one declared area: on-page SEO auditing of a single page. However, the declared description presents a much broader and more comprehensive toolkit, including competitor analysis, keyword tracking, GEO scoring, PDF generation, and ongoing monitoring. None of those capabilities appear in this code chunk. The script only fetches one URL, evaluates basic on-page signals, writes a JSON file, and prints a terminal summary. While storing audit files under timestamped paths could support later historical review, the code itself does not implement monitoring or trend analysis. Therefore the supplied code chunk materially underdelivers relative to the declared purpose, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code is related to SEO auditing, so it partially matches the broad domain, but the declared description substantially overstates the implemented functionality in this supplied chunk. The actual script only performs a technical SEO audit and optional PageSpeed lookup for a single URL, storing results locally as JSON. There is no evidence here of competitor analysis, keyword ranking tracking, GEO readiness/scoring, PDF generation, or broader comprehensive toolkit behavior. Because the declared purpose presents a much wider set of core capabilities than the code actually provides, this is a meaningful description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk is a report generator script, not a comprehensive SEO/GEO audit toolkit. It reads existing audit JSON files from a local workspace and writes a .md report. While this partially aligns with the declared reporting/audit context, several prominently declared capabilities are absent in the supplied code: no crawling or audit execution, no competitor analysis, no keyword tracking, no time-series monitoring logic, and no PDF generation. The actual primary purpose of this code is narrower than advertised, so the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code substantially matches part of the description: it performs on-page SEO checks, technical SEO checks, content/schema/social checks, and a basic GEO readiness score for a supplied URL. However, the declared description presents a broader 'comprehensive' toolkit with competitor analysis, keyword tracking, PDF report generation, client reporting, and monitoring over time. None of those capabilities appear in this code chunk. The code only fetches a single page via HTTP, parses HTML, computes scores/issues, prints a console summary, and optionally writes JSON output. Because several headline capabilities in the declared purpose are absent and the actual scope is materially narrower, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The provided code chunk only demonstrates crawling a single site and invoking an SEO audit for each page, then printing and saving a JSON summary. That partially matches the declared on-page/technical SEO audit functionality. However, the declared description presents a much broader toolkit with competitor analysis, keyword ranking tracking, GEO readiness scoring, PDF report generation, and longitudinal monitoring, none of which are evidenced in this code chunk. There are no suspicious undeclared capabilities beyond normal web fetching and file output for the audit task, but the description materially overstates the implemented functionality shown here.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a broad, comprehensive SEO and GEO toolkit with multiple major capabilities, including competitor analysis, keyword tracking, GEO readiness scoring, PDF report generation, and longitudinal monitoring. The supplied code chunk does not implement those features. Instead, it performs a narrow technical audit: HTTP status/load timing, HTTPS/redirect checks, robots.txt inspection including AI bot blocking, sitemap presence, and optional PageSpeed API scoring. While this does fit one subset of the declared purpose—technical SEO checks—it materially underdelivers relative to the comprehensive toolkit description. There is no evidence in this chunk of competitor analysis, keyword rank tracking, GEO scoring logic, PDF generation, or time-series monitoring. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script embeds the user-controlled URL directly into a Python string inside a python3 -c one-liner. An attacker can supply a crafted URL containing quotes and Python syntax to break out of the string and execute arbitrary Python code on the host, which goes far beyond the intended GEO audit behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises and documents capabilities that use network access, environment variables, and persistent file read/write, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, missing scope declarations can cause the skill to be invoked with broader privileges than users expect, increasing the chance of unintended data access, outbound requests, or filesystem modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill performs outbound requests to websites and third-party APIs/search services, but the description does not warn users that target URLs, keywords, and potentially business-sensitive audit data may be transmitted externally. This can create privacy, confidentiality, and compliance risks, especially for client work or internal domains.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide explicitly instructs users to create and download a service-account JSON key, which is a highly sensitive credential that can grant API access if exposed. Omitting handling, storage, rotation, and least-privilege guidance increases the chance that users will save, share, commit, or distribute the key insecurely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script accesses BRAVE_API_KEY from the environment and uses it to authenticate outbound requests, but there is no warning or disclosure that credential material will be consumed for network activity. The surrounding output only reports failure states and does not clearly tell the user that an environment-provided API key will be used.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/analyze-competitor.sh (reported line 54)May include surrounding context.
sh
if brave_key: try: search_resp = requests.get( "https://api.search.brave.com/res/v1/web/search", headers={"X-Subscription-Token": brave_key}, params={"q": keyword, "count": 10}, timeout=10

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/track-keywords.sh (reported line 94)May include surrounding context.
sh
if brave_key: try: search_resp = requests.get( "https://api.search.brave.com/res/v1/web/search", headers={"X-Subscription-Token": brave_key}, params={"q": keyword, "count": 10}, timeout=10

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs an outbound HTTP request to a user-supplied URL and writes a detailed report to local storage without any explicit user-facing disclosure or confirmation. In an agent setting, hidden network access and filesystem writes can surprise users, expose internal URLs or browsing targets, and leave potentially sensitive audit artifacts on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script automatically sends the user-supplied target URL and a locally available PAGESPEED_API_KEY to Google's external PageSpeed API without any user-facing notice, consent, or opt-in. This can unintentionally disclose sensitive audit targets, internal/staging URLs, or usage tied to the operator's API key to a third party, which is especially risky in an agent skill that may be run on arbitrary user-provided URLs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: User-supplied keywords are sent to Brave's external search API, which can expose potentially sensitive client strategy, campaign terms, or unreleased business priorities to a third party. While this is necessary for the feature to work, the script does not provide explicit disclosure or consent at the point of transmission, creating a privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description explicitly says the skill 'Generates PDF reports,' suggesting PDF output is part of the implemented behavior. However, the report generation section documents only Markdown and HTML output formats, creating a direct mismatch between the advertised capability and the described behavior in the skill file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill stores audit data and configuration, including API-key-related settings, in a persistent workspace but does not prominently warn users about retention or sensitivity. In multi-tenant or shared-agent environments, silent persistence can expose site data, reports, or configuration details to later sessions or other components with filesystem access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Telling users to set an environment variable pointing to the service-account key is a common configuration pattern, but without any warning it may encourage insecure handling of credential paths and associated secrets in shell history, process environments, shared profiles, or deployment configs. In combination with the previous step, it normalizes credential use without teaching safe storage and access controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code creates and writes a report file under a workspace directory, which is a file-write operation covered by the warning requirement for code files. Although the script prints the report path after writing, there is no warning, confirmation, or pre-action disclosure before the write occurs, and the write behavior is not explained in comments beyond the high-level audit description.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest describes technical SEO checks and site performance monitoring, which justifies fetching the target site and related SEO resources like robots.txt and sitemap.xml. However, this script additionally inspects the local environment for PAGESPEED_API_KEY and uses it to access Google's PageSpeed Insights API, introducing credential use and dependency on a third-party service that is not explicitly stated in the skill description or this script's documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script persists tracking results to a timestamped JSON file under the user's workspace, but the code provides no prior warning in usage text, comments, or prompts that keyword queries and ranking results will be stored locally. Because this is a file write involving user-provided keywords and site data, it meets the code-file warning criterion.
Content: No source excerpt is available for this finding.