ClawHub
Back to skill

Security audit

Meta Tags Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward SEO meta tag helper, with the main caution being an optional unpinned command to install a larger skills bundle.

Install this if you want help drafting SEO and social sharing metadata. Avoid running the optional install-all `npx` command unless you trust the publisher and can verify or pin the package version, and confirm the target language/locale before using generated tags on non-US or non-English pages.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:35
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:35
Vulnerability Type: Supply-chain exposure through an unpinned third-party installation command
Risk Level: Medium

Vulnerable Code Snippet:

markdown
> **[SEO & GEO Skills Library](https://skills.sh/aaron-he-zhu/seo-geo-claude-skills)** · 20 skills for SEO + GEO · Install all: `npx skills add aaron-he-zhu/seo-geo-claude-skills`

Technical Analysis

The documentation recommends executing npx skills without pinning the CLI package to a reviewed version. It also identifies the skill collection by a mutable package name rather than an immutable version or commit. Depending on the local npx and package-manager configuration, the command may retrieve and execute the latest available CLI package.

Consequently, the code that ultimately runs or the skills that are installed can change after this project has been audited. Compromise of the relevant package, publisher account, registry distribution path, or a later upstream release could convert the documented command into a code-execution or malicious-skill delivery channel.

The audited project does not automatically execute this command, and no malicious payload was present in the reviewed files. Exploitation requires a user or automation system to follow the installation instruction.

Attack Path

  1. An attacker compromises the publisher account, upstream package, distribution channel, or a future release associated with the unpinned CLI or skill collection.
  2. The attacker publishes a modified package or skill release containing malicious installation or runtime behavior.
  3. A user follows the command documented at SKILL.md:35.
  4. npx resolves and retrieves the mutable package version available at execution time.
  5. The retrieved CLI executes, or it installs attacker-controlled skills.
  6. The malicious component operates with the permissions of the user or automation account that invo ...[truncated 734 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to a specific reviewed version, rather than allowing npx to resolve the latest release.
  2. Pin the requested skill collection to a supported immutable version or commit hash if the installer permits it.
  3. Document the expected package registry and upstream repository so users can verify package provenance.
  4. Publish and verify cryptographic checksums or signatures for downloaded artifacts.
  5. Use npx options that prohibit silent substitution or unexpected package installation where supported.
  6. Prefer a reviewed lockfile-based or locally vendored installation process for security-sensitive environments.
  7. Run installation under a least-privileged account without access to production credentials.
  8. Review package lifecycle scripts and installed skill contents before enabling them.
  9. Add automated dependency monitoring so pinned versions can be deliberately reviewed and updated when security fixes are released.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

Required OG Tags:

html
<!-- Primary Open Graph Tags -->
<meta property="og:type" content="[article/website/product]">
<meta property="og:url" content="[Full canonical URL]">
<meta property="og:title" content="[OG-optimized title - up to 60 chars]">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.

Copy and paste this complete meta tag block:

html
<!-- Primary Meta Tags -->
<title>[Optimized Title]</title>
<meta name="title" content="[Optimized Title]">
<meta name="description" content="[Optimized Description]">

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

CTR improvement is a broad marketing objective that could refer to ads, email, SERP snippets, or on-page experiments, not specifically meta tag optimization. The manifest text does not sufficiently constrain this trigger to organic search snippets or metadata work.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Because this markdown/manifest file defines activation triggers, the standalone trigger "meta tags" is vague enough to overlap with many ordinary discussions or broad SEO requests. The file does not provide exclusion conditions or negative examples to narrow when this skill should activate instead of related SEO skills.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Natural-language policy requires avoiding forced language or locale settings unless the user is given a choice or the constraint is clearly justified. Here the instructions present og:locale as en_US by default for a general-purpose skill, with no step asking the user to confirm the intended locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This is a general-purpose skill, but it instructs use of lang="en" as the language example without user opt-in or a documented region-specific reason. That can lead to language/locale policy violations for pages targeting other languages.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guidance sets og:locale to en_US, and later also uses <html lang="en">, which implies a fixed language/locale default. In a reusable skill description, this can create ambiguous activation/output expectations for non-English or non-US pages because no opt-in or selection step is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.