Security audit

Siluzan SEO

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but its installer asks agents to run unverified remote scripts, install software globally, and force-write skill files across many AI assistant directories.

Install only after reviewing the installer and accepting broad system changes. Prefer manual, pinned installation; avoid the one-click curl/iex commands; do not run the installer with administrator/root privileges; check and restore npm registry settings afterward; and register the skill only in the specific assistant directory you intend to use rather than all global agent directories.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:17
Finding: Mutable Remote Installer Is Executed Directly from Documentation
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.sh:52
Finding: Bash Installer Executes Unverified Remote Scripts, Including with Root Privileges
Content: View full analysis
/dev/null 2>&1; then info "Installing Node.js LTS via Homebrew..." brew install node@22 brew link --overwrite node@22 2>/dev/null || true else info "Installing Node.js LTS via install-node.vercel.app..." curl -fsSL https://install-node.vercel.app/lts | bash -s -- --yes fi ;; linux) if command -v apt-get >/dev/null 2>&1; then info "Installing Node.js 22.x via NodeSource (apt)..." curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt-get install -y nodejs elif command -v yum >/dev/null 2>&1; then info "Installing Node.js 22.x via NodeSource (yum)..." curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo -E bash - sudo yum install -y nodejs else info "Installing Node.js LTS via install-node.vercel.app..." curl -fsSL https://install-node.vercel.app/lts | bash -s -- --yes fi ;; ``` ### Technical Analysis The installer downloads scripts from `install-node.vercel.app` and NodeSource and pipes them directly into Bash. The response is not pinned to a digest and is not authenticated through a detached signature. The Linux package-manager branches are particularly dangerous because the downloaded response is executed by `sudo -E bash`. This grants mutable remote content root-level execution while preserving parts of the caller's environment. A compromised response can therefore do substantially more than configure a Node.js repository. The non-privileged fallback remains unsafe because it still grants arbitrary code execution under the current user. The `install-node.vercel ...[truncated 1140 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.ps1:105
Finding: Unverified Vendor-Hosted Git Executable Is Silently Installed
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/install.sh:146
Finding: Third-Party CLI Force-Writes Skill Files Across Multiple Global AI Agent Directories
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/install.sh:133
Finding: Installer Persistently Redirects the User's npm Registry to a Third-Party Mirror
Content: View full analysis
/dev/null || echo "") if [ "$current_registry" != "$NPM_MIRROR" ] && [ "$current_registry" != "${NPM_MIRROR}/" ]; then info "Switching npm registry to China mirror for faster downloads..." npm config set registry "$NPM_MIRROR" info "npm registry set to $NPM_MIRROR" else info "npm registry already set to China mirror" fi ``` The configured mirror is: ```bash readonly NPM_MIRROR="https://registry.npmmirror.com" ``` Equivalent PowerShell behavior: ```powershell $currentRegistry = '' try { $currentRegistry = (npm config get registry 2>$null).Trim() } catch {} if ($currentRegistry -ne $NPM_MIRROR -and $currentRegistry -ne "$NPM_MIRROR/") { Write-Info 'Switching npm registry to China mirror for faster downloads...' npm config set registry $NPM_MIRROR Write-Info "npm registry set to $NPM_MIRROR" } else { Write-Info 'npm registry already set to China mirror' } ``` ### Technical Analysis `npm config set registry` modifies persistent npm configuration rather than applying a registry only to the current installation command. The prior value is read but never saved for restoration. The change also occurs without explicit user consent. As a result, later and unrelated npm operations inherit a new supply-chain trust boundary. This persists beyond the Skill installation. The behavior is unnecessary because the package can be installed from the existing configured registry or, if justified, a registry can be scoped to one command. No evidence establishes that the mirror is malicious. The vulnerability is the silent, persistent redirection and the resulting exposure of future dependency operations to an additional ...[truncated 1048 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (55)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is SEO JSON/schema generation, but the skill also instructs the agent to perform environment setup, remote installation, global package installation, and forced registration into assistant skill directories. This mismatch is dangerous because users invoking a content-generation skill would not reasonably expect persistent system modifications or global agent configuration changes.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
根据任务类型 **必须先 Read 对应子目录的 `SKILL.md`**，再按 prompts 与 **`schemas/output.json`** 执行：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
根据任务类型 **必须先 Read 对应子目录的 `SKILL.md`**，再按 prompts 与 **`schemas/output.json`** 执行：

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says this skill is for structured SEO JSON deliverables such as landing page schemas, blog launch packages, and guest post JSON, and explicitly says ordinary writing without schema should use a different skill. This file, however, is a full system prompt for generating complete long-form blog article content in English and Chinese, including writing style, word count, headings, FAQ, and translation, which goes beyond merely producing structured JSON fields for deployment packages.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The script downloads and immediately executes an external installer from install-node.vercel.app via bash. This creates a classic supply-chain execution risk: compromise of the endpoint, DNS, TLS trust chain, or served script results in arbitrary code execution on the user's machine.
Content: Scanner excerpt · scripts/install.sh (reported line 61)May include surrounding context.
sh
brew link --overwrite node@22 2>/dev/null || true else info "Installing Node.js LTS via install-node.vercel.app..." curl -fsSL https://install-node.vercel.app/lts | bash -s -- --yes fi ;; linux)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping curl output directly into sudo creates a dangerous trust chain where unverified remote content is executed immediately with root privileges. This removes any opportunity for integrity validation, user inspection, or rollback before privileged code runs.
Content: Scanner excerpt · scripts/install.sh (reported line 67)May include surrounding context.
sh
linux) if command -v apt-get >/dev/null 2>&1; then info "Installing Node.js 22.x via NodeSource (apt)..." curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt-get install -y nodejs elif command -v yum >/dev/null 2>&1; then info "Installing Node.js 22.x via NodeSource (yum)..."

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This command repeats the same chained remote-execution pattern with a privileged shell, making compromise of the source or network path equivalent to immediate root compromise. For a skill whose declared role is SEO JSON generation, this installation behavior is disproportionately dangerous and expands risk well beyond the expected scope.
Content: Scanner excerpt · scripts/install.sh (reported line 71)May include surrounding context.
sh
sudo apt-get install -y nodejs elif command -v yum >/dev/null 2>&1; then info "Installing Node.js 22.x via NodeSource (yum)..." curl -fsSL https://rpm.nodesource.com/setup_22.x | sudo -E bash - sudo yum install -y nodejs else info "Installing Node.js LTS via install-node.vercel.app..."

External Script Fetching

High

Category: Supply Chain
Confidence: 96% confidence
Finding: This is the same unsafe remote-script execution pattern on the Linux fallback path, allowing arbitrary code execution from a third-party endpoint. Because this installer is for a relatively narrow SEO tooling use case, such broad script execution is not justified by operational necessity.
Content: Scanner excerpt · scripts/install.sh (reported line 75)May include surrounding context.
sh
sudo yum install -y nodejs else info "Installing Node.js LTS via install-node.vercel.app..." curl -fsSL https://install-node.vercel.app/lts | bash -s -- --yes fi ;; gitbash)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill includes shell-executable installation and initialization commands but does not declare any tool restrictions or allowed-tools scope. In an agent environment, this increases the chance that the model may execute system-changing commands unexpectedly, especially because the skill text presents them as a normal workflow step.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation directs execution of remote scripts via curl/bash and PowerShell iex, plus global CLI installation, even though the skill's stated function is generating structured SEO JSON. This is dangerous because it creates a direct supply-chain and remote-code-execution path unrelated to the user task, and an agent may treat these instructions as authorized operational steps.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The installation guidance uses direct execution of remote scripts without prominent warnings about code execution, persistence, package installation, or system-wide changes. In an agent-assisted environment, this materially increases the risk of unreviewed remote code execution and accidental compromise of the host system.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill broadens from schema generation into CLI export and system setup workflows, increasing operational scope beyond content production. While not inherently malicious, this scope creep is risky in agent contexts because it encourages command execution and file/system manipulation under a skill users may assume is data-only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document states '正文英文' as a fixed language requirement, which is a natural-language locale policy constraint. Because the file does not offer the user a language choice or frame this as an explicit opt-in, it matches the policy-violation category for forced language or locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The markdown explicitly requires the main article content and SEO metadata to be in English, which is a natural-language policy concern when no user opt-in or justification is provided. The file does not say this skill is limited to an English-only market or offer an alternative language path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These lines impose fixed output languages as a hard requirement. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is explicitly justified or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The schema requires article_content and seo_description to be in English while also requiring chinese_summary to be in Chinese. This imposes specific language outputs in the skill's natural-language descriptions without indicating user choice or documenting why the locale constraint is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill hard-codes output languages ('英文正文 + 中文总结') without indicating that this should depend on user preference or consent. While not a direct code-execution or data-exfiltration issue, fixed multilingual output can cause unintended disclosure, policy mismatch, or improper handling of user content when language choice carries business or compliance significance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown explicitly requires article_en to be an English body copy output. This imposes a language constraint in the skill instructions without offering the user a language/locale choice or documenting a justified region-specific exception.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt instructs the model in Chinese ('你是一位拥有多年经验的 SEO 技术顾问') and later requires a Chinese summary and full Chinese translation, but does not indicate that the user can opt into another language. This is a natural-language locale policy concern because it imposes a specific language behavior without explicit user choice or a clearly documented region-specific justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt instructs the agent to generate full English article prose, a Chinese summary, and a complete Chinese translation, which materially exceeds the skill metadata claiming this skill is only for structured JSON SEO deliverables and not general writing. This mismatch can cause unsafe routing and policy bypass at the orchestration layer, because users may obtain broader content-generation behavior than operators expect or have approved.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema requires chinese_summary and article_zh, and their descriptions explicitly mandate Chinese-language content. This is a natural-language policy concern because the file forces a specific locale/output language without any indication of user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description says the skill generates SEO blog articles from an enterprise knowledge base, but it does not clearly limit when the skill should or should not activate. In an agent environment, vague routing boundaries can cause the skill to be selected for broader writing tasks than intended, which may lead to unintended data retrieval from RAG sources and output generation outside the user’s true request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description mandates a fixed output format and languages: English body, Chinese summary, and full Chinese translation, without indicating that this depends on user preference. Forcing multilingual output can override user intent, increase unnecessary disclosure of retrieved knowledge, and create prompt-routing behavior that is misaligned with the actual request.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says this skill is for generating industrial B2B overseas SEO structured JSON deliverables and explicitly distinguishes itself from general writing workflows. This file documents a command that converts Markdown, plain text, and SEO JSON into Word/PDF deliverables, which is a materially broader document-export capability than generating structured SEO JSON alone.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documented inputs include arbitrary Markdown and plain text files, with formatting heuristics for headings and FAQ sections. For a skill whose stated purpose is generating SEO landing-page/blog/guest-post JSON packages, a general-purpose text-to-docx/pdf conversion feature is not clearly justified by that purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.