SEO Optimizer Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:31 AM UTC
• Version: 1.0.8

Overview

The skill mostly does what it claims, but its privacy documentation contradicts the actual behavior of sending content to third-party AI providers.

Install only if you are comfortable sending analyzed content excerpts to the chosen AI provider under that provider's terms. Do not use confidential, regulated, or proprietary text unless the privacy wording is corrected and you have reviewed the provider policy; prefer selective dependency installation over the full requirements file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: seo_optimizer.py:420

Finding

Prompt Injection Through Untrusted Content Embedded in AI Instructions

Content

View full analysis

Dict: """Get AI-powered optimization suggestions from the selected model.""" keyword_context = "" if keywords: keyword_context = f"\n\nTarget keywords to naturally incorporate: {', '.join(keywords)}" prompt = f"""You are an expert SEO content strategist. Analyze this content and provide specific, actionable optimization suggestions. Content: {text[:2000]} {keyword_context} Please provide: 1. Title optimization (40-60 chars with target keyword) 2. Meta description (150-160 chars) 3. H1 tag suggestion 4. 3-5 key points to expand 5. Natural keyword integration suggestions 6. Internal linking opportunities Format as JSON with keys: title, meta_description, h1, key_points, keyword_integration, internal_links""" response_text = self._call_ai(prompt, max_tokens=1000) ``` ```python def _get_aeo_recommendations(self, text: str, keywords: Optional[List[str]] = None) -> List[str]: """Get Answer Engine Optimization (AEO) recommendations.""" keyword_context = "" if keywords: keyword_context = f"Focus on these keywords: {', '.join(keywords[:3])}" prompt = f"""As an Answer Engine Optimization (AEO) expert, analyze this content for optimization in AI search results (ChatGPT citations, Google AI Overviews, Claude, etc). Content excerpt: {text[:1500]} {keyword_context} Provide 5 specific AEO recommendations to: 1. Get featured in AI search results 2. Appear as a cited source in AI-generated responses 3. Improve visibility in ChatGPT, Google AI Overviews, and similar platforms Format as a simple numbered list.""" response_text = self._call_ai(prompt, max_tokens=5 ...[truncated 2079 chars]

Remediation

View remediation

other

Note

• Location: SKILL.md:349

Finding

Contradictory Privacy Statement Misrepresents External Content Transmission

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:42

Finding

Unbounded Dependency Ranges and Unnecessary Default Provider SDK Installation

Content

View full analysis

=0.40.0 openai>=1.60.0 google-generativeai>=0.8.0 mistralai>=1.3.0 ``` Related installation metadata in `manifest.yaml:64-73` states: ```yaml dependencies: python: ">=3.9" packages: - "anthropic>=0.40.0" # Required ONLY for Claude models - "openai>=1.60.0" # Required ONLY for GPT and Llama (via OpenRouter) models - "google-generativeai>=0.8.0" # Required ONLY for Gemini models - "mistralai>=1.3.0" # Required ONLY for Mistral models install_all: "pip install anthropic openai google-generativeai mistralai" install_selective: | # Install ONLY the SDK for your chosen provider: pip install anthropic # Claude pip install openai # GPT, DeepSeek, xAI, MiniMax, Qwen, Llama (OpenAI-compat) pip install google-generativeai # Gemini pip install mistralai # Mistral ``` ### Technical Analysis Every dependency uses only a lower bound. Consequently, installation at different times may select arbitrary future versions that were not reviewed with this project. There are no upper bounds, exact pins, hashes, or lock file to make installation reproducible. Moreover, a standard installation from `requirements.txt` installs all four provider SDKs even though `_init_client` imports only the SDK selected by the model. This increases the number of direct and transitive packages that must be trusted. No evidence was found that the named packages are typosquatted or currently malicious. The finding concerns preventable exposure to future compromised, incompatible, or unexpectedly changed releases. ### Attack Path 1. A user or automated build runs `pip install -r requirements.txt`. 2. The resolver ...[truncated 941 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation tells users their content is sent to third-party AI providers, then elsewhere claims the opposite: that content is not transmitted to external servers and there is no third-party data sharing. This kind of privacy contradiction is dangerous because users may rely on the stronger claim when deciding whether to process confidential business, personal, or regulated content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly states earlier that user content is sent to third-party AI providers, but the later security section claims content is 'not stored or transmitted to external servers' and that there is 'no third-party data sharing.' These contradictory assurances can mislead users into submitting sensitive or regulated data under false privacy assumptions, creating a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends user-supplied content to external AI providers for analysis, which can expose sensitive or proprietary text to third parties. Although a privacy notice exists, there is no technical control for redaction, consent enforcement, provider allowlisting per data sensitivity, or local-only mode, so accidental data disclosure remains likely in normal use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · seo_optimizer.py (reported line 122)May include surrounding context.

python

("mixtral-",     "mistral",    "MISTRAL_API_KEY",    None),
        ("devstral-",    "mistral",    "MISTRAL_API_KEY",    None),
        ("ministral-",   "mistral",    "MISTRAL_API_KEY",    None),
        ("deepseek-",    "deepseek",   "DEEPSEEK_API_KEY",   "https://api.deepseek.com/v1"),
        ("grok-",        "xai",        "XAI_API_KEY",        "https://api.x.ai/v1"),
        ("MiniMax",      "minimax",    "MINIMAX_API_KEY",    "https://api.minimax.io/v1"),
        ("minimax",      "minimax",    "MINIMAX_API_KEY",    "https://api.minimax.io/v1"),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · seo_optimizer.py (reported line 123)May include surrounding context.

python

("devstral-",    "mistral",    "MISTRAL_API_KEY",    None),
        ("ministral-",   "mistral",    "MISTRAL_API_KEY",    None),
        ("deepseek-",    "deepseek",   "DEEPSEEK_API_KEY",   "https://api.deepseek.com/v1"),
        ("grok-",        "xai",        "XAI_API_KEY",        "https://api.x.ai/v1"),
        ("MiniMax",      "minimax",    "MINIMAX_API_KEY",    "https://api.minimax.io/v1"),
        ("minimax",      "minimax",    "MINIMAX_API_KEY",    "https://api.minimax.io/v1"),
        ("qwen",         "qwen",       "DASHSCOPE_API_KEY",  "https://dashscope-intl.aliyuncs.com/compatible-mode/v1"),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · seo_optimizer.py (reported line 124)May include surrounding context.

python

("ministral-",   "mistral",    "MISTRAL_API_KEY",    None),
        ("deepseek-",    "deepseek",   "DEEPSEEK_API_KEY",   "https://api.deepseek.com/v1"),
        ("grok-",        "xai",        "XAI_API_KEY",        "https://api.x.ai/v1"),
        ("MiniMax",      "minimax",    "MINIMAX_API_KEY",    "https://api.minimax.io/v1"),
        ("minimax",      "minimax",    "MINIMAX_API_KEY",    "https://api.minimax.io/v1"),
        ("qwen",         "qwen",       "DASHSCOPE_API_KEY",  "https://dashscope-intl.aliyuncs.com/compatible-mode/v1"),
        ("meta-llama/",  "openrouter", "OPENROUTER_API_KEY", "https://openrouter.ai/api/v1"),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · seo_optimizer.py (reported line 125)May include surrounding context.

python

("ministral-",   "mistral",    "MISTRAL_API_KEY",    None),
        ("deepseek-",    "deepseek",   "DEEPSEEK_API_KEY",   "https://api.deepseek.com/v1"),
        ("grok-",        "xai",        "XAI_API_KEY",        "https://api.x.ai/v1"),
        ("MiniMax",      "minimax",    "MINIMAX_API_KEY",    "https://api.minimax.io/v1"),
        ("minimax",      "minimax",    "MINIMAX_API_KEY",    "https://api.minimax.io/v1"),
        ("qwen",         "qwen",       "DASHSCOPE_API_KEY",  "https://dashscope-intl.aliyuncs.com/compatible-mode/v1"),
        ("meta-llama/",  "openrouter", "OPENROUTER_API_KEY", "https://openrouter.ai/api/v1"),

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation says the input may be "HTML or plain text content" and later labels the metrics stage as "technical SEO" analysis, which implies inspection of HTML structure. However, the code first removes all tags in _extract_text and then calculates heading and link metrics from the stripped text, causing headings_structure and internal_links_count to be inaccurate or always absent for real HTML input.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.md (reported line 105)May include surrounding context.

md

## Disclaimer of Warranties

THE SKILL IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO:
- Merchantability or fitness for a particular purpose
- Non-infringement of third-party rights
- Accuracy of SEO or ranking recommendations

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower-bound version only, so builds can resolve to different releases over time, including releases later found to be vulnerable or malicious. This weakens reproducibility and makes it impossible to verify whether deployed environments are using a safe version.

Content

Scanner excerpt · requirements.txt (reported line 42)May include surrounding context.

text

#   pip install anthropic>=0.40.0 openai>=1.60.0 google-generativeai>=0.8.0 mistralai>=1.3.0

# Full package list (for reference):
anthropic>=0.40.0
openai>=1.60.0
google-generativeai>=0.8.0
mistralai>=1.3.0

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest does not pin anthropic, so there is no way to determine from this file whether the installed version includes known advisories or fixes. In a skill that connects to external AI providers, unverifiable dependency state increases supply-chain risk and complicates patch assurance.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using openai>=1.60.0 leaves the final installed version unconstrained above the minimum, which can introduce unreviewed behavior changes or vulnerable releases. The main risk is supply-chain and reproducibility failure rather than direct exploitation from this file alone.

Content

Scanner excerpt · requirements.txt (reported line 43)May include surrounding context.

text

# Full package list (for reference):
anthropic>=0.40.0
openai>=1.60.0
google-generativeai>=0.8.0
mistralai>=1.3.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The google-generativeai package is not pinned to a single vetted version, so installs may drift across environments and time. That makes vulnerability assessment and incident response harder because the actual installed version is unknown.

Content

Scanner excerpt · requirements.txt (reported line 44)May include surrounding context.

text

# Full package list (for reference):
anthropic>=0.40.0
openai>=1.60.0
google-generativeai>=0.8.0
mistralai>=1.3.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

mistralai>=1.3.0 permits installation of any newer release, and this package has known malicious-package advisories in its ecosystem history. In this context, leaving it unpinned increases the chance of accidentally consuming a compromised or unsafe release and prevents verifying whether the environment is affected.

Content

Scanner excerpt · requirements.txt (reported line 45)May include surrounding context.

text

anthropic>=0.40.0
openai>=1.60.0
google-generativeai>=0.8.0
mistralai>=1.3.0

Unverifiable Dependency: mistralai has 2 known advisory(ies) (GHSA-wx9m-wx4f-4cmg (Malicious dropper in mistralai 2.4.6 PyPI package); MAL-2026-3608 (Malicious code in mistralai (PyPI))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Because mistralai is unpinned and there are advisories indicating malicious code in specific PyPI releases, the file cannot assure that installation will avoid compromised versions. This is more dangerous than ordinary version drift because a malicious package can lead to arbitrary code execution during install or runtime.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.