Security audit

GEO Pulse — Brand AI Visibility Intelligence

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it sends brand data to a public plaintext HTTP API and uses unsafe command examples that deserve review before installation.

Review this skill before installing it for client or confidential brand work. It may send brand names, domains, metrics requests, and generated analysis to an external service at a default plaintext HTTP endpoint. Prefer configuring a trusted HTTPS GEO_PULSE_BASE_URL, avoid using sensitive unreleased client information, and ensure the agent safely serializes JSON rather than substituting brand names directly into shell commands.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:27
Finding: Plaintext HTTP Communication with a Public API Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:64
Finding: Unsafe Shell and JSON Interpolation of User-Controlled Brand Names
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:111
Finding: Untrusted Remote API Content Is Inserted into Client-Facing Reports
Content: View full analysis
Report date: {date} | Domain: {domain} ## Brand Overview {brand_overview} ## Core GEO Metrics | Metric | Value | |--------|-------| | Visibility Score | {visibility_score} | | Brand Mention Rate | {brand_mention_rate × 100}% | | Link Reference Rate | {link_reference_rate × 100}% | | Brand Mentions | {brand_mention_count} | | Link References | {link_reference_count} | | Sentiment | Positive {positive} / Neutral {neutral} / Negative {negative} | ## Platform Performance | Platform | Mentions | Links | Positive | Neutral | Negative | |----------|----------|-------|----------|---------|----------| (from platform breakdown) ## Competitor Benchmark | Brand | Visibility Score | Brand Visibility | Link Visibility | |-------|------------------|------------------|-----------------| (sorted by visibility_score desc; mark target brand with ⭐) ## Recommendations {suggestion} ``` ### Technical Analysis The report template directly incorporates fields returned by an external service, including `brand_overview`, platform data, competitor data, and `suggestion`. The skill does not require schema validation, content escaping, URL filtering, or a rule that remote text must be treated only as untrusted data. Consequently, a compromised service or network attacker can supply Markdown formatting, deceptive links, fabricated claims, or instruction-like text. Because the default API transport is plaintext HTTP, the remote-content trust issue can be combined with traffic interception even without compromising the API server. There is no explicit instruction in the skill to execute remote content as code. The risk is therefore primarily report-content injection, misleading output, and possible indirect prompt manipulation rather than confirmed remote code e ...[truncated 1306 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to send user-supplied brand data to an external public endpoint without a clear user-facing disclosure or consent step. This creates a data handling and privacy risk because proprietary client names, domains, or competitive analysis requests may be transmitted off-platform to an untrusted third-party service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The skill performs direct network access to a public endpoint over plain HTTP, which exposes requests and responses to interception or tampering in transit. Even though the example request fetches a brand list, the broader skill repeatedly transmits brand identifiers and analysis data externally, making the insecure transport and external transmission materially risky in context.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
bash
BASE_URL="${GEO_PULSE_BASE_URL:-http://8.148.223.19:8000}" curl -s "$BASE_URL/api/brands"

Expected structure:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list for historical analysis includes vague phrases such as “可见度变化”, “visibility trend”, and “历史对比”, which are generic enough to overlap with many unrelated analytics or reporting requests. The section does not provide narrowing context or negative examples to ensure the skill activates only for GEO/brand AI visibility use cases.
Content: No source excerpt is available for this finding.