Security audit
Security checks for vulnerabilities and agentic risk
This SEO content skill is coherent and disclosed, with the main caveat that several templates are Vietnamese-specific and may need adjustment for other sites.
Install this if you want a structured SEO cluster-writing workflow and are comfortable with the agent researching your site and competitors online. Before using it for non-Vietnamese sites, explicitly tell the agent the target language, locale, currency, and UI labels to use so the vi/vi-VN templates are not copied unchanged.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<body>
<div class="page">
<!-- 1. PAGE HEADER (.pg-hd) -->
<!-- 2. AUDIT BOX (.audit) — pre-existing issues found in research -->
<!-- 3. TABLE OF CONTENTS (.toc) — links to each article section -->
<!-- 4. ARTICLE BLOCKS (.art) × N — one per article -->
The trigger block is very broad and explicitly says to 'always use this skill' for common SEO/content-cluster requests. That can cause unintended invocation on loosely related user prompts, leading the agent to fetch sites, perform external research, and follow a rigid workflow the user did not request. In an agent setting, overbroad activation is a real security/control issue because it can override user intent and expand tool use unnecessarily.
The skill states that it encodes the exact workflow used for Vietnamese-language clusters for pinata.vn, and the listed trigger phrases also mix in Vietnamese examples, but the document does not state that language or locale should be chosen based on user preference. This can bias outputs toward a specific locale without explicit opt-in or a documented region-specific constraint.
This CSS file includes instructional comments entirely in Vietnamese, such as usage guidance about where to copy or link the stylesheet. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and no alternative language choice or locale justification is provided in the file.
The markdown explicitly instructs the operator to search for the target keyword in Vietnamese, which imposes a specific language/locale on skill behavior. The file does not offer a user choice, opt-in mechanism, or explain that the skill is limited to a Vietnam-specific compliance or regional use case.
The schema template hard-codes "inLanguage": "vi-VN" for all articles, which can cause incorrect metadata when the client site or requested output language is not Vietnamese. This can lead to mislabeling of content for search engines and downstream systems, creating integrity and compliance issues if users expect language to follow site settings or explicit instructions.
The template hard-codes lang="vi", Vietnamese UI text, and locale-specific output without checking user preference or target audience. In an agent skill, this can cause silent misdelivery of content in the wrong language/locale, leading to incorrect publication output, SEO mismatches, and user deception if the agent presents content as generally applicable.
No suspicious patterns detected.