Site Launch Checklist

• Outcome: Review
• Latest audit: Jun 10, 2026 · 4:14 PM UTC
• Version: 1.1.0

Overview

The skill appears aimed at site-launch and SEO operations, but it also describes persistent automation, credential-backed fallbacks, external posting, and permission-bypassing scheduled runs that need careful review.

Install only if you are comfortable with a site-operations skill that may set up analytics, use SEO credentials, create recurring automation, and send reports to external services. Before using it, require explicit confirmation for third-party installs, tracking tools, credential-based API calls, Slack delivery, and any scheduled agent; avoid permission-bypass cron runs unless you have a tightly sandboxed environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill goes beyond auditing/orchestration and instructs the agent to enumerate and install third-party skill packs via npm-backed commands. That expands the trust boundary to external repositories and package-management actions, which can introduce supply-chain risk and unexpected capability growth during a pre-launch checklist run.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs creation of a recurring weekly SEO agent with MCP integrations, extending a one-time launch checklist into persistent automation with access to analytics, search-console data, and web search. Persistent agents increase the blast radius because they may continue operating after the initial user intent has ended and can accumulate privileged integrations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation text contains broad phrases like 'checklist for the site', 'ready to ship', and 'site review', which are likely to match ordinary conversation and trigger the skill unexpectedly. Overbroad activation is dangerous here because the skill can lead into external installs, third-party service setup, and persistent agent creation beyond a simple advisory response.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file directs the agent to install several analytics and observability services by default across multiple site types, but it does not require any privacy notice, consent handling, data-processing review, or regional compliance checks before doing so. In a site-launch skill, this is operationally dangerous because it can cause unnecessary third-party data collection, trigger GDPR/ePrivacy/CCPA compliance failures, and expose user telemetry to multiple vendors without explicit user approval.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly instructs the agent to fall back to curl with a service account credential file when GSC MCP access is unavailable, but provides no guardrails on secret handling, scoping, or disclosure. In a headless or semi-automated context, this increases the risk of exposing credentials in commands, logs, shell history, error output, or unintended outbound requests.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The recommended cron invocation uses `claude --dangerously-skip-permissions` for scheduled weekly execution, which bypasses normal permission prompts while granting the agent autonomous file and network actions. Because this agent is designed to read config, access credentials, fetch external resources, write reports, and possibly post to Slack, headless execution without interactive consent materially raises the risk of unintended data access, modification, or exfiltration.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill allows posting report content to Slack, an external third-party service, without requiring a warning or confirmation that SEO findings, indexing status, backlink intelligence, and operational issues may leave the local environment. This can leak sensitive business information to the wrong workspace, channel, or webhook destination if misconfigured.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The agent definition authorizes fallback to API calls via `curl` or `web_fetch` using credentials stored in `.env`, but does not constrain how secrets are loaded, where requests may be sent, or how outputs are sanitized. In practice this can cause accidental credential exposure and broaden the set of external systems receiving site data, especially during automated or partial-failure paths.

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.