fix-my-site

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:30 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for fixing website issues, but it requires running an unbundled local validator from a dynamically located skills directory.

Install only if you trust the Groundcrew skills root and the groundcrew-doctor.py validator it will execute. Before use, confirm that validator's source, path, ownership, and version are expected, and avoid enabling paid or credentialed SEO/analytics connectors unless you intentionally configured them for this workflow.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:10

Finding

Execution of an Unverified External Validation Tool

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Unverified local tool execution
Risk Level: Medium

Vulnerable Code Snippet

markdown

Locate the active skills root and run `<skills-root>/.groundcrew/groundcrew-doctor.py --evidence <record.json>` before using them in a conclusion.

Technical Analysis

The skill instructs the agent to discover an “active skills root” dynamically and execute groundcrew-doctor.py from that location. The referenced script is not included in the audited project, and the instruction does not require the agent to verify the resolved canonical path, ownership, integrity, provenance, or cryptographic digest of the executable before running it.

This creates a local tool-spoofing risk: an attacker who can influence the selected skills root or replace the .groundcrew/groundcrew-doctor.py file can cause a legitimate-looking validation command to execute attacker-controlled Python code. The project’s references to evidence validation do not mitigate arbitrary code execution by an untrusted validator.

The finding is constrained to the execution instruction. The supplied artifact contains no copy of the validator, so the validator’s implementation and actual behavior could not be audited.

Attack Path

1. An attacker gains write access to a directory that may be selected as the active skills root, or influences skills-root discovery so that an attacker-controlled directory is selected.
2. The attacker creates or replaces .groundcrew/groundcrew-doctor.py with a malicious Python program.
3. The agent loads this skill and follows the instruction in SKILL.md.
4. The agent resolves <skills-root> to the attacker-controlled or compromised location.
5. The agent executes the spoofed validator while processing an evidence record.
6. The malicious program runs with the permissions and accessible environment of the agent process.

Impact Assessment

Successful exploitation perm ...[truncated 647 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the validator in the reviewed skill package so its implementation is included in security review and version control.
2. Resolve the validator only from a trusted, immutable installation directory rather than a dynamically discovered writable skills root.
3. Canonicalize the path and reject symlinks, path traversal, unexpected ownership, and user-writable parent directories.
4. Pin an approved validator version and verify a cryptographic digest or signature before execution.
5. Invoke the validator through a fixed interpreter and argument array without shell interpolation.
6. Run validation in a sandbox with minimal filesystem access, no unnecessary credentials, and network access disabled unless explicitly required.
7. Fail closed when provenance or integrity cannot be established; do not use unvalidated evidence in conclusions.
8. Document the trusted installation source, expected digest, permissions, and verification procedure directly in the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/connectors.md (reported line 48)May include surrounding context.

md

- **Tier 1.** Google Suggest for expansion (unofficial endpoint; treat as hints, `confidence: low`). A SERP the user pastes or fetches is an observation for that query, locale, device, and date — record all four.
- **DataForSEO.** Paid, per-request. Read `dataforseo.md`; show the cost preflight and get approval for each batch.
- **Ahrefs MCP** (`https://api.ahrefs.com/mcp/mcp`, API key on a plan that includes MCP) and **Semrush MCP** (`https://mcp.semrush.com/v1/mcp`, OAuth or API key). Use only when the user already pays for the tool and has configured the MCP in their client. Label rows `source: "ahrefs"` / `"semrush"`, `confidence` per the vendor's own accuracy notes; these are third-party estimates, not the user's own data.
- **TrustGrowth.** `keywords` (typed opportunities with volume, difficulty, intent, current position, scores) for the verified site. SERP snapshots per keyword are scheduled (TEC-7796).

### `~~link database` — backlinks and authority