Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent SEO audit skill with disclosed website/code/content analysis behavior and no evidence of hidden execution, persistence, or credential theft.
Install only if you want your agent to perform SEO audits on URLs, repositories, HTML, or content you provide. Approve external website checks and competitor analysis deliberately, and do not submit staging, internal, confidential, or non-owned URLs to IndexNow, Search Console, or similar services.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Required meta tags:
<!-- Title tag: 50-60 characters, unique per page, primary keyword near start -->
<title>Primary Keyword - Secondary Keyword | Brand Name</title>
<!-- Meta description: 150-160 characters, includes CTA, unique per page -->
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<h1>Welcome</h1>
<h1>Our Products</h1>
<!-- BAD: Skipped heading level -->
<h1>Main Title</h1>
<h3>Subsection</h3> <!-- Skipped H2 -->
The usage examples are broad enough that a host agent could trigger this skill from ordinary user requests like 'audit this website' or 'what should I fix first?' without clear boundaries. Over-broad activation increases the chance of unintended URL fetching, code inspection, or competitor-site analysis in contexts where the user did not explicitly consent to those actions.
Referencing the IndexNow endpoint in direct submission instructions reinforces a workflow that sends site URLs to an external service. The risk is contextual: the data is not inherently secret, but in some environments unpublished URLs, staging domains, or internal paths could be exposed if a user follows the guidance blindly.
curl -X POST "https://api.indexnow.org/indexnow" \
-H "Content-Type: application/json" \
-d '{
"host": "example.com",
Referencing the IndexNow endpoint in direct submission instructions reinforces a workflow that sends site URLs to an external service. The risk is contextual: the data is not inherently secret, but in some environments unpublished URLs, staging domains, or internal paths could be exposed if a user follows the guidance blindly.
curl -X POST "https://api.indexnow.org/indexnow" \
-H "Content-Type: application/json" \
-d '{
"host": "example.com",
The README says the skill can evaluate websites, codebases, and competitor sites, but it does not disclose that this may involve accessing external URLs or inspecting supplied source content. That omission can mislead users and orchestration layers about data access behavior, creating privacy, consent, and unexpected network-action risks.
The skill recommends submitting URLs to external indexing services and search consoles without an explicit user warning or consent checkpoint. While the section is instructional rather than self-executing, it could still lead an agent or user to transmit site metadata to third parties without understanding privacy, ownership, or disclosure implications.
No suspicious patterns detected.