Search Optimization Agent

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed SEO helper skill with broad activation wording, but no hidden code, persistence, or destructive behavior was found.

Safe to install as an SEO guidance skill. Before using it for live audits, confirm the target site is yours or authorized, approve crawl scope, and use trusted configuration for SEO service credentials rather than pasting long-lived keys into chat.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger section uses very broad automatic activation phrases such as general SEO-, keyword-, ranking-, and optimization-related terms. In an agent ecosystem, this can cause the skill to activate during ordinary conversation without explicit user intent, leading to unintended tool use, incorrect routing, or unnecessary processing of user-provided URLs/content.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description, tags, keywords, and triggers are broad enough to match many normal discussions about SEO or search optimization. This increases the chance of accidental selection of the skill over more appropriate handlers, which is especially risky here because the skill advertises external API access and website crawling/auditing capabilities.

VirusTotal

65/65 vendors flagged this skill as clean.