site-launch-checklist

• Outcome: Review
• Latest audit: Aug 21, 2026 · 12:27 PM UTC
• Version: 1.2.0

Overview

The skill is a coherent website launch checklist, but its optional weekly SEO agent can create recurring automation that uses local credentials and may send report data to Slack, so it belongs in Review.

Review the weekly SEO agent before enabling it. Prefer scoped MCP credentials over .env curl fallbacks, avoid unattended runs with broad permissions, configure Slack only if report contents are safe to share there, and inspect any companion skills before installing them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to enumerate and install additional third-party skill packs at runtime, materially expanding the execution and instruction surface beyond the original checklist. Even though it says to ask for confirmation and avoid full-pack installs, pulling unpinned external skills into the environment creates supply-chain and prompt-scope risk, because newly installed skills may have broader permissions or adversarial instructions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill goes beyond a one-time launch audit by instructing creation of a persistent weekly SEO agent with MCP connectors and scheduled background behavior. That expands scope from assessment to long-lived automation, increasing the chance of over-privileged access, unintended data exposure, and ongoing actions the user may not fully understand at invocation time.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to bypass the preferred MCP integrations by reading secrets from `.env` and making direct `curl` calls to external APIs. This expands the trust boundary to local credential material and arbitrary network egress, creating a real risk of unintended secret access, misuse of API credentials, or transmission to the wrong endpoint, especially in an autonomous scheduled workflow.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to fall back to direct authenticated API access using credentials from `.env` via `curl` or `web_fetch` when MCPs are unavailable. This expands the trust boundary from approved tools to arbitrary outbound requests with secrets, increasing the risk of credential misuse, exfiltration, and unintended access to third-party services beyond the narrowly scoped SEO workflow.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly authorizes fallback API access using `run_shell_command` (`curl`) or `web_fetch` with credentials from `.env`, which expands its capability beyond passive SEO analysis into arbitrary outbound authenticated requests. In a local skill context, this increases the chance of credential misuse, accidental leakage, or overbroad access to third-party services if prompts, configs, or referenced task files are tampered with.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill can transmit report content to Slack via webhook even though that outbound messaging behavior is not clearly declared in the high-level skill description. This creates a hidden data egress path, so site metrics, blockers, or internal operational details could be sent to an external destination without sufficiently explicit user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The prompt explicitly authorizes fallback to `run_shell_command` with `curl` and credentials stored in `.env`, expanding a reporting/maintenance agent into direct secret-consuming command execution. That creates unnecessary access to sensitive tokens and increases the chance of credential exposure, command misuse, or unintended outbound requests beyond the minimum capability needed for the task.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation description uses broad trigger phrases like 'checklist for the site', 'ready to ship', and 'site review', which can cause the skill to activate for many generic website conversations. In context, this is more dangerous because the skill is not read-only: it can ask to install packages, write files, and orchestrate changes, so accidental triggering can escalate from guidance to environment modification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manifest grants Edit and Write capabilities, and the body instructs file creation/modification such as TONE.md, config changes, and agent-definition files, but the manifest/description does not clearly warn that repository files may be changed. This undermines informed consent and is riskier here because the skill is user-invocable and also recommends installing external components, so users may reasonably expect an audit but receive state-changing actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Posting report content to a Slack webhook via `run_command` causes outbound transmission of potentially sensitive operational data without any explicit consent or warning in the skill flow. Because the report may include blockers, traffic data, indexing issues, or partial-failure details, this can leak internal business information to an external destination silently.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The fallback mechanism combines credential access from `.env` with direct outbound API requests but gives no user-facing notice that secrets may be read and transmitted over the network. In a recurring automation context, this is especially dangerous because it normalizes silent secret handling and external communication, increasing the chance of accidental exfiltration or policy violations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill performs persistent writes and may transmit report content to Slack and external web services, but the skill description does not clearly warn operators about these side effects. This weakens informed consent and increases the chance the skill is run in environments where sensitive analytics, SEO, or internal site data is unintentionally stored or sent to third parties.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs sending report content to a Slack webhook, which transmits potentially sensitive operational, traffic, SEO, and competitor-analysis data to an external third-party service without any explicit consent, scoping, or data-minimization guidance. In an agentic workflow, automatic posting increases the chance of unreviewed disclosure, especially if reports include internal URLs, incidents, roadmap clues, or partial credentials/error output.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to use credentials from .env for direct API calls via curl but does not include safeguards around secret handling, output redaction, or restrictions on where responses may be written or echoed. This creates a realistic risk of accidental secret exposure in command history, logs, reports, or downstream tool output, and also normalizes external transmission of site data without clear operator awareness.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Posting the Summary and Blockers sections to Slack via webhook is an external data transfer, yet the file does not present a clear user-facing warning or consent step before sending potentially sensitive operational information off-platform. Even if the content is SEO-oriented, reports may contain internal issues, outages, indexing problems, or business-sensitive performance data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instruction to use credentials stored in `.env` for external API calls lacks any warning or safeguards around secret access, handling, and transmission. In agentic workflows, that omission is dangerous because it normalizes broad secret use and can lead to accidental exposure in commands, logs, reports, or requests to unintended endpoints.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs posting report content to a Slack webhook, which sends operational site data to an external service without any explicit user warning, confirmation, or scope limitation. Weekly SEO reports can include sensitive business intelligence such as rankings, blockers, internal metrics, competitor observations, and partial outage details, so silent transmission increases the risk of unintended data disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to use credentials stored in .env for bash/curl or webfetch API requests, but provides no safety guidance on secret handling, output redaction, or prevention of accidental disclosure. In a tool-enabled agent context with bash, write, and network access, this increases the chance that credentials are exposed in logs, written into reports, or mishandled during fallback flows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to post report content to a Slack webhook automatically, but provides no user-facing consent, review step, or data-classification warning before transmitting information to an external service. Even if only Summary and Blockers are sent, those sections may contain sensitive operational, analytics, SEO, or site-health details that should not be exfiltrated silently.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The prompt instructs the agent to use credentials from `.env` for API access without warning about secret handling or limiting which variables may be read. In skill context, this is more dangerous because a routine maintenance agent does not need broad ambient credential access, and normalizing `.env` reads increases the risk of accidental secret disclosure or misuse across tools.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to create and continuously append historical SEO memory files and changelog data, including metrics and page-level information, and explicitly says to never truncate or overwrite them. In unattended weekly operation, this creates ongoing data retention without a clear retention policy, user warning, or minimization controls, which can lead to unnecessary accumulation of sensitive business telemetry and broaden exposure if the repo, workspace, or logs are later accessed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill recommends posting weekly SEO reports to Slack and includes a Slack webhook in the sample config, but it does not clearly warn users that internal site metrics, rankings, backlink data, and operational findings may be transmitted to an external third-party service. This can cause unintended data disclosure, especially in unattended runs where reports are sent automatically without per-run review.

Static analysis

No suspicious patterns detected.