Security audit

Geo Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a China-market GEO marketing toolkit, but its diagnostic and monitoring tools can present simulated or unperformed checks as real results.

Review carefully before installing. The templates are suitable for a Chinese/China-market park marketing workflow, but do not rely on the included diagnostic or monitoring reports as real measurements unless the scripts are fixed to perform actual checks and clearly label simulated data. Use explicit output paths, treat configs as untrusted input, and publish only approved public business contact information.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/monitor.py:62
Finding: Fabricated AI monitoring results are presented as genuine measurements<![CDATA[ ## Vulnerability Details **File Location**: `scripts/monitor.py`, lines 62–83 **Vulnerability Type**: Simulated API results presented as real monitoring data **Risk Level**: High ### Vulnerable Code ```python def _simulate_ai_search(self, keyword: str, platform: str) -> Dict: """模拟AI搜索查询注意：实际环境中需要调用各AI平台的搜索API 这里提供框架代码 Args: keyword: 搜索关键词 platform: AI平台名称 Returns: 搜索结果 """ # 实际实现需要调用真实API # 这里返回模拟数据作为框架演示 return { 'keyword': keyword, 'platform': platform, 'timestamp': datetime.now().isoformat(), 'results': [ { 'rank': 1, 'source': '官方网站', 'title': f'{self.config["park_name"]}官方网站', 'snippet': '...', 'cited': True, 'accuracy': 0.95 } ], 'park_mentioned': True, 'park_rank': 1, 'sentiment': 'positive' } ``` ### Technical Analysis The monitoring function does not contact DeepSeek, Doubao, Kimi, or any other AI platform. Instead, it returns fixed favorable results for every keyword and platform: - First-place ranking - Positive sentiment - Successful citation - Park mention confirmation - A fixed accuracy score of 95% These fabricated values are subsequently aggregated by `run_monitoring()`, stored in `geo_monitor_history.json`, and included in reports that appear to represent actual platform measurements. Although the source code comments identify the behavior as simulation, the generated reports do not clearly distinguish simulated data from production observations. This is best classified as tool spoofing because a monitoring tool advertised as measuring external AI-platform behavior substitutes internally manufactured results for genuine API responses. ### Attack Path 1. A user creates or selects a monitoring configuration containing keywords and AI platform names. 2. The user ru ...[truncated 1187 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable simulation mode by default. 2. Require an explicit option such as `--simulation` before generating synthetic data. 3. Add a prominent `data_source: simulated` field to every simulated record. 4. Display a clear warning at the top of every simulated Markdown and JSON report. 5. Exclude simulated records from production history and trend calculations. 6. Implement separate authenticated adapters for each supported AI platform. 7. Store source evidence for genuine measurements, including request timestamps, platform identifiers, returned citations, and raw response references where permitted. 8. Return `unavailable` or `not_checked` when no supported API integration exists instead of manufacturing a successful result. 9. Add automated tests ensuring that simulation output cannot be labeled or persisted as production monitoring data. 10. Update the README and package metadata to state accurately which platforms are genuinely integrated. ]]>

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/diagnostic.py:32
Finding: Diagnostic reports score checks that were never performed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/diagnostic.py`, lines 32–78 **Vulnerability Type**: Hard-coded diagnostic outcomes presented as completed checks **Risk Level**: Medium ### Vulnerable Code ```python def _check_url_accessibility(self) -> Dict: """检查URL可访问性""" # 注意：实际环境中需要使用requests库 # 这里提供基础框架 return { 'status': 'unknown', 'https_enabled': True, 'response_time': 0, 'issues': [] } def _check_llms_txt(self) -> Dict: """检查llms.txt部署情况""" result = { 'name': 'llms.txt部署', 'score': 0, 'status': '❌ 缺失', 'checks': [] } llms_url = f"{self.url}/llms.txt" # 检查项 checks = [ { 'name': 'llms.txt存在性', 'passed': False, 'detail': f'访问 {llms_url}' }, { 'name': '内容完整性', 'passed': False, 'detail': '检查必需字段' }, { 'name': '更新时效', 'passed': False, 'detail': '检查最后更新时间' }, { 'name': '格式规范', 'passed': False, 'detail': '检查Markdown格式' } ] passed_count = sum(1 for c in checks if c['passed']) result['score'] = int(passed_count / len(checks) * 100) result['checks'] = checks if result['score'] == 100: result['status'] = '✅ 完善' elif result['score'] >= 50: result['status'] = '⚠️ 需改进' return result ``` ### Technical Analysis The diagnostic tool does not issue an HTTP request, retrieve `llms.txt`, parse website HTML, or inspect response metadata. The URL accessibility method returns placeholder values and is not included in the diagnostic execution list. The `llms.txt` checks are hard-coded to fail without accessing the constructed URL. The same fixed-failure pattern is used for Schema, metadata, content quality, and most technical SEO checks. Nevertheless, `run_diagnostics()` prints th ...[truncated 1458 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Introduce explicit result states such as `passed`, `failed`, `not_checked`, `unsupported`, and `error`. 2. Exclude `not_checked` and unsupported checks from numerical scoring. 3. State prominently when no network request or page inspection occurred. 4. Do not print that a check is running unless the underlying operation is implemented. 5. Implement HTTP diagnostics with: - Connection and read timeouts - Redirect limits - Maximum response-size limits - Allowed content-type validation - Safe TLS verification 6. Add SSRF protection before enabling network requests: - Resolve hostnames before connecting - Reject loopback, link-local, private, multicast, and reserved addresses unless explicitly authorized - Revalidate destinations after redirects - Prevent DNS-rebinding bypasses 7. Parse `llms.txt`, HTML metadata, and JSON-LD only after successful bounded retrieval. 8. Preserve evidence such as HTTP status, final URL, content type, and retrieval timestamp. 9. Add tests proving that unreachable, valid, invalid, and unimplemented checks are reported differently. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generator.py:149
Finding: Configuration-derived filename allows path traversal and file overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generator.py`, lines 149–157 **Vulnerability Type**: Unsanitized path construction and unsafe file creation **Risk Level**: Medium ### Vulnerable Code ```python content = self._process_config() if output_path is None: park_name = self.config.get('name', 'park') output_path = f"./{park_name}_llms.txt" with open(output_path, 'w', encoding='utf-8') as f: f.write(content) print(f"✅ llms.txt 生成成功：{output_path}") return output_path ``` ### Technical Analysis When the user does not provide `--output`, the generator constructs the destination path directly from the `name` property of the JSON configuration. The value is not sanitized or restricted to a filename. A crafted name may contain: - `..` traversal components - Forward or backward path separators - Absolute-path syntax on supported platforms - Names targeting predictable symlinks The file is opened with mode `w`, which truncates an existing destination. The implementation also follows symbolic links. Consequently, a malicious or untrusted configuration can cause output to be written outside the intended working directory. The fixed `_llms.txt` suffix limits which exact filenames can be targeted through the default path, but it does not prevent traversal or overwrite of matching files. In shared or privileged execution environments, predictable output filenames also create a symlink-overwrite risk. ### Attack Path 1. An attacker supplies or modifies a JSON configuration containing a path-like park name, for example: ```json { "name": "../shared/report", "description": "Attacker-controlled content" } ``` 2. A user runs the generator without explicitly specifying `--output`: ```bash python scripts/generator.py --config malicious_config.json ``` 3. The script constructs: ```text ./../shared/report_llms.txt ``` 4. Python resolves the traversal component and opens the file outside the ...[truncated 1045 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat the park name as display data, not as a filesystem path. 2. Convert it to a restricted filename slug containing only an approved set of characters. 3. Reject path separators, absolute paths, `.` components, and `..` components. 4. Require an explicit trusted output directory. 5. Resolve the final destination and verify that it remains inside that directory: ```python output_dir = Path("./output").resolve() safe_name = slugify(str(self.config.get("name", "park"))) destination = (output_dir / f"{safe_name}_llms.txt").resolve() if output_dir not in destination.parents: raise ValueError("Output path escapes the approved directory") ``` 6. Create the output directory with restrictive permissions where appropriate. 7. Use exclusive creation mode (`x`) when overwriting is not intended. 8. If replacement is required, request explicit overwrite confirmation or require a `--force` option. 9. Refuse symbolic-link destinations by checking with `lstat()` and using platform-supported no-follow semantics where available. 10. Write to a securely created temporary file in the same directory and atomically replace the destination only after validation. 11. Document that configuration files must be treated as untrusted input. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill asks users to prepare and publish phone number, email, detailed address, and website information as part of generated llms.txt and Schema content. Because this markdown file is the user-facing description, it should warn that only intended public business contact data should be used and that personal or private information should not be exposed.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The title and entire skill description are written as a Chinese-language skill system and repeatedly prescribe Chinese-language platform and content practices, but nowhere offer users a language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly recommends using '正面内容压制' to handle negative evaluations, which promotes reputation manipulation rather than factual correction. In a GEO/AI-optimization context, this can be used to drown out legitimate criticism or safety-relevant information, causing AI systems and users to receive a distorted view of reality.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file-level description claims the tool detects GEO deployment status and generates a remediation checklist, but the implemented checks are largely hardcoded placeholders and do not validate the target site. This can mislead operators into trusting a fabricated assessment, causing insecure deployments or missed remediation because the report appears authoritative without performing real verification.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This Python file contains user-facing natural-language descriptions entirely in Chinese, including the tool name and purpose, but does not indicate that language selection is optional or region-specific. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a natural-language policy concern.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The accessibility check function claims to test URL accessibility but returns a fixed dummy object with 'unknown' status and preset values, performing no request at all. In a diagnostic/security-adjacent tool, this is dangerous because downstream reports may be interpreted as evidence that basic reachability and HTTPS properties were validated when they were not.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The script prints progress, errors, report labels, and argparse help text in Chinese only, which imposes a locale choice on all users of the skill. There is no command-line flag, configuration, or documentation allowing users to select another language or indicating that the tool is intentionally limited to a Chinese-language audience.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: This code file contains natural-language strings that effectively force a specific language/locale for users, including the module docstring and later CLI help/output text. Under the stated policy, locale-specific behavior should either be optional for the user or clearly justified as region-specific.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The module title and functional description are written only in Chinese, and the rest of the user-facing strings in the script are also Chinese-only. This imposes a specific language/locale on users without any opt-in or documented justification, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The entire template is written in Chinese and presents fixed Chinese headings and question phrasing, which indicates the skill is designed to produce output in a specific language. There is no visible user opt-in, language choice, or justification that this skill is intended only for a Chinese-language or region-specific workflow.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The template content is written entirely in Chinese, including the descriptive header and all section labels, which imposes a fixed language/locale on generated output. There is no indication that users can opt into another language or that the Chinese-only constraint is required for a region-specific compliance purpose.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This manifest-style JSON template fixes `scheduleTimezone` to `Asia/Shanghai` and `addressCountry` to `CN`, which imposes a specific locale on all generated events. Under the policy, locale constraints should be explicitly justified or offer user choice; this template provides neither.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The template fixes `priceCurrency` to `CNY` and `inLanguage` to `["zh-CN", "en"]`, which embeds a locale/language policy into all generated output. Because the file does not indicate that this is a region-specific template or let users choose alternatives, it may violate the language/locale policy.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This manifest-like JSON template includes fixed locale values such as addressCountry set to "CN", and elsewhere constrains service area and content language context to China-specific settings. The file does not offer a user choice or explain that it is intended only for a China-region deployment, which can violate language/locale policy requirements for explicit opt-in or documented justification.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This JSON template contains multiple fixed Chinese-language strings, such as the seller name suffix and later property names/units, while providing no natural-language indication that the skill is intentionally region-specific or that users can opt into this locale. Under the stated policy, forcing a specific language/locale without opt-in is a reportable natural-language policy issue.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The README presents 'English | 简体中文' with Chinese selected by default, and the rest of the document is entirely in Simplified Chinese. Under the language/locale policy, forcing a specific language without explicit user opt-in can be considered a natural-language policy issue, even though an English alternative exists via link.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The entire skill content is presented only in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: This plain-text skill content presents all user-facing information in Chinese and does not indicate that the language is optional, user-selected, or justified as a region-specific constraint. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: This JSON file contains user-facing natural-language fields such as name, description, address, and catalog text in Chinese, but it does not indicate that the locale is intentionally fixed or that alternative language options are available. Under the language/locale policy rule, forcing a single language without documented user choice can be a policy concern.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: This manifest-style JSON uses Chinese-language values throughout fields such as name, description, brand, seller, and additionalProperty labels, with no indication that the skill is region-specific or that users can opt into this locale. The stated policy requires flagging language or locale constraints when they are imposed without user choice or clear justification.

Intent-Code Divergence

Low

Confidence: 77% confidence
Finding: The tool saves the current monitoring result into history before report generation uses `_get_period()`. As a result, on an initial run `len(self.history)` is already 1 and later behavior can make the displayed reporting period reflect stored history state rather than a true pre-run monitoring interval, which diverges from the report's apparent intent to describe the monitored period. This is a documentation/intent mismatch in the generated report semantics rather than a direct security behavior issue.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The heading text is written as a prescriptive Chinese template label, and the entire document structure is authored in Chinese with no indication that language selection is optional. This can violate language/locale policy when a skill should not force a specific language without user opt-in.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This markdown template is entirely written in Chinese and presents a fixed-language reporting format, with no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.