T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:85- Finding
Unpinned Third-Party Code Is Retrieved and Executed at Runtime
- Content
View full analysis
- Remediation
View remediation
Security audit
site-launch-checklist
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent website launch helper, but it also enables unpinned third-party installs, recurring agents, raw credential-backed API calls, and outbound report/proxy data flows that need careful review.
Install only if you are comfortable reviewing each remote skill/tool before use, pinning versions or commits yourself, keeping Slack webhooks and API credentials out of committed config, and disabling unattended/headless runs unless they use a tightly sandboxed account with read-only credentials and explicit approvals for shell, writes, and outbound posting.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/weekly-seo-agent.md:14- Finding
Scheduled Agent Can Run Persistently with Permission Checks Disabled
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
assets/weekly-seo-opencode.md:4- Finding
OpenCode Agent Grants Automatic Bash Execution Alongside Web and Write Access
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/weekly-seo-agent.md:245- Finding
Slack Webhook Credential Is Designed to Be Stored in Repository-Local Plaintext Configuration
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:271- Finding
Analytics May Be Routed Through an Author-Controlled Third-Party Proxy
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (40)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation description includes broad phrases like "ready to ship," "before I go live," and "asks for a site review," which can occur in many ordinary conversations and may cause unintended activation. The trigger guidance also mixes several general scenarios without clear exclusion conditions or negative examples to narrow when the skill should versus should not run.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The skill instructs use of
npx skillswithout pinning an exact package version. Becausenpxresolves and executes code from the registry at runtime, a future compromised, typo-swapped, or breaking package version could run arbitrary code in the agent environment during listing or install workflows.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This line tells the agent to enumerate remote skill packs using unpinned
npx skills add owner/repo --list. Even a read-like listing operation requires executing theskillspackage, so the harness is exposed to supply-chain compromise or unexpected behavior from newly published versions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill includes installation of external skill packages but does not provide an upfront safety warning in the user-facing description that networked package installation may occur. Even though later sections ask for confirmation, users may invoke the skill expecting a checklist and not realize it can fetch and import third-party content into the environment.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This line leads to bulk installation of externally hosted sub-skills via
npx skills add ... --skill ...without pinning the installer version or the fetched content to immutable revisions. That creates a direct remote-code and prompt-supply-chain path: a modified upstream pack can introduce malicious instructions or code into the agent workflow.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The prohibition on installing full packs is good, but the workflow still repeatedly uses unpinned
npx skills addfor later installs. Because these installs are conditional and happen mid-session, users may approve them without seeing that arbitrary updated upstream content will execute or be imported.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill directs creation of repository files such as
TONE.mdwithout clearly warning in the top-level description that it may modify the repo. Silent file creation can alter project state, contaminate commits, or introduce governance issues in environments where users expected analysis only.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The humanizer installation command uses unpinned
npx skills addagainst a GitHub URL, which adds another remote dependency execution path. Pulling directly from a mutable repository URL increases exposure to repository compromise, tag retargeting, or malicious updates in a package that will influence later content-generation behavior.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The skill sends the target site URL to
api.securityheaders.com, a third-party external service. While the transmitted data is not highly sensitive by default, this leaks user infrastructure targets and assessment activity to an external party and could be problematic for private, prelaunch, or confidential domains.- Content
Full header dump:
curl -sI https://example.com
External graders:
curl -s "https://api.securityheaders.com/?q=https://example.com&followRedirects=on&hide=on" -I | grep -i 'x-grade'
text **SEO files (Phase 5):**
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
Running
npx unlighthousewithout a pinned version executes whatever package version is current at invocation time. In an automated launch workflow, that creates supply-chain risk and can also produce nondeterministic audit behavior or break the agent unexpectedly.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The fallback directs the agent to read credentials from
.envand userun_commandwithcurlfor direct API access, expanding the skill from structured tool use into arbitrary credential-backed network operations. This broadens the blast radius significantly because the agent can access secrets and make external requests outside the narrower MCP abstraction, increasing risk of misuse, overcollection, or accidental leakage.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The fallback mechanism uses credentials from
.envto make direct external API calls, yet the skill provides no explicit warning that secrets will be accessed and transmitted to third-party services. In a security-sensitive agent environment, hidden secret consumption plus network egress is dangerous because users may not realize the skill can bypass higher-level integrations and operate with raw credentials.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to transmit report content to a Slack webhook, which sends potentially sensitive operational data outside the local workspace and core reporting path. Because this happens automatically when a webhook is configured and without an explicit confirmation step, it creates an unintended data-exfiltration channel beyond the stated SEO analysis function.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Posting the Summary and Blockers sections to Slack via webhook is an external data transfer, but the skill does not clearly warn the user at execution time that report content may leave the environment. Even if intended for operational convenience, silent outbound sharing can expose internal performance issues, traffic data, or strategic SEO information to third-party systems.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file defines an ongoing weekly monitoring agent with persistent memory files, recurring execution, and multi-service data collection, which materially exceeds the parent skill's stated purpose of a pre-launch checklist. That scope mismatch is dangerous because users may invoke a seemingly one-time launch audit skill without realizing it also establishes continued monitoring behavior and broader access to analytics, search, and reporting systems.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs fallback to credentials stored in
.envand allows posting report content to a Slack webhook, which creates a path for secret use and external data transmission without an explicit consent or scoping step at execution time. In a skill framed around site launch operations, this broadens capability into authenticated data access and outbound messaging, increasing the risk of unintended secret exposure or exfiltration if the skill is invoked in the wrong context or modified inputs steer what gets posted.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions describe using credentials from
.envand transmitting report data to Slack without an explicit warning, confirmation, or data-handling notice. That is dangerous because operators may not realize the skill will access sensitive tokens and send potentially confidential site performance or business data to an external service, creating avoidable secret-handling and privacy risks.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The fallback path directs the agent to make external API requests via curl using credentials from .env, but provides no guardrails for secret handling, destination validation, or user awareness of outbound data transfer. This increases the risk of inadvertent credential exposure, misuse of overly broad API tokens, or sending site data to unintended endpoints during automated runs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to post report content to a Slack webhook, which sends potentially sensitive operational data off-platform to an external endpoint. Even if limited to Summary and Blockers, those sections can include traffic, indexing, infrastructure, or competitive intelligence details, and the skill does not require explicit user confirmation or a disclosure warning before transmission.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to use credentials from .env for external API access via curl or web_fetch, which creates a path for secret handling and outbound authenticated requests beyond simple local reporting. This is dangerous because it normalizes implicit secret use without constraining which credentials may be accessed, how they are scoped, or how request destinations are validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Referencing credentials in .env for fallback API calls without warning about secret handling or transmission risks is a genuine security weakness. It can lead users or downstream agents to treat sensitive tokens casually, increasing the chance of overbroad secret use, accidental leakage in command logs, or requests to unintended endpoints.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill exfiltrates generated report content to an external Slack webhook when configured, but it does not present this as a distinct data-transfer action requiring explicit user awareness or confirmation. Even if the report is operational in nature, it may contain sensitive business metrics, traffic data, incident details, or internal URLs, so silent outbound posting expands the data exposure boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Slack posting behavior is described as automatic if a webhook is configured, but the skill gives no user-facing warning that portions of the report will leave the local environment and be transmitted to Slack. That missing transparency can cause unintended disclosure of operational or analytics data to external systems or channels with broader access than expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the agent to post portions of the generated report to a Slack webhook, which transmits potentially sensitive operational, analytics, and search-console-derived information to an external service. Because this happens automatically and without an explicit user-facing confirmation or clear scoping/redaction guidance, it creates a real data exfiltration and privacy risk if the report contains internal metrics, site issues, competitor analysis, or credentials-adjacent context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt authorizes fallback to curl or web_fetch using credentials stored in .env, enabling outbound authenticated requests to external services. This creates a real risk of unintended credential use, broader-than-expected data exfiltration, and unsafe handling of secrets because the prompt does not impose approval gates, destination restrictions, or masking requirements.
- Content
Static analysis
No suspicious patterns detected.