Security risk report for @forgecat/zubair-trabzada_geo-seo-claude v0.1.3
Source Integrity
Low
Profile sourced from GitHub repository (https://github.com/zubair-trabzada/geo-seo-claude) with MIT license and clear attribution.
No supply-chain poisoning indicators; dependencies are standard Python packages (requests, playwright, pandoc) with no typosquatting or attacker-controlled packages.
Static scanner confirms low risk; no malicious package recommendations or backdoored code templates detected.
Agent Intent
Low
Content describes legitimate SEO/GEO analysis workflows and best practices; no instructions to ignore system prompts, read credentials, or exfiltrate data.
Detailed agent instructions (geo-ai-visibility, geo-content, geo-schema, geo-technical, geo-platform-analysis) are technical guidance for website auditing, not manipulation of the AI system itself.
References to fetching URLs, parsing robots.txt, and analyzing brand mentions are normal audit operations, not exfiltration or prompt injection attacks.
No guidance poisoning: profile does not instruct weakening security defaults, installing malicious dependencies, or systematically steering outputs toward attacker goals.
Details
Findings
Invisible characters detected
skills/geo-compare/SKILL.md · SKILL-011
Evidence
geo-ai-visibility.md: 'Use WebFetch to retrieve the target URL. Extract all meaningful content blocks...' — describes legitimate content analysis, not credential theft.
geo-technical.md: 'Fetch /robots.txt from the domain root. Parse it for directives...' — standard SEO audit procedure.
geo-schema.md: 'Detect existing structured data... validate against Schema.org specifications' — legitimate markup validation, not system prompt leakage.
skills/geo/SKILL.md: 'GEO-first SEO analysis tool. Optimizes websites for AI-powered search engines...' — describes the tool's purpose transparently.
Permissions
PRM-000Medium
All agent files declare `allowed-tools: Read, Bash, WebFetch, Write, Glob, Grep` — the combination of Bash and Write alongside WebFetch is broader than a read-only audit tool would require, enabling arbitrary shell command execution and file creation.
The Bash permission is used for legitimate purposes (running Python scripts, fetching URLs via curl), but it grants the agent unrestricted shell access which exceeds the minimum necessary for an SEO auditing function.
The Write permission allows creating and modifying files on the local filesystem; while used for report generation, this is a medium-risk capability that goes beyond pure analysis.
Bash used for: "python3 ~/.claude/skills/geo/scripts/fetch_page.py <url> page" — executes local scripts from a path that could be modified
MCP Risk
Low
No MCP servers are defined in the profile; all operations are Claude Code skills using standard allowed-tools (Read, Bash, WebFetch, Write, Glob, Grep).
No hidden instructions in tool descriptions; all skill descriptions are transparent about their purpose (GEO analysis, content auditing, schema validation).
No arbitrary binary execution or unrestricted filesystem/network access beyond what is necessary for the audit workflow.
Details
Evidence
Profile metadata: 'MCP servers (untrusted data): (none)' — no MCP server definitions present.
All operations use standard Claude Code allowed-tools; no custom MCP bindings or external service integrations.
ForgeCat