Skip to content
skillsafebeta
← Report library
Purpose / Other

未命名 Skill Security Audit

What the author says it does (original text)

源文件没有提供可直接读取的简短用途说明。

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The install command fetches an active skill from external sources without showing or pinning its implementation

Source references: 2
What we found

The command invokes a tool through `npx` and installs the active version by repository and skill name. It shows no commit hash or version tag, and the supplied material contains neither the target skill's code nor the installer's code.

Why this matters

If run, what is installed—and anything executed during installation—depends on the external package and repository state resolved at that time. This signpost file cannot establish its permission requirements, file operations, or network behavior.

The material directs users to an active implementation in an external repository and tells them to install it with `npx skills add`, but it neither shows the installer and target implementation nor pins a repository commit or version. The risk arises only if the user runs the command; this material cannot establish what would actually be fetched or executed then. Users can restrict network installation and request a reviewable pinned commit and installation manifest.

SKILL.md:7In the instructionsOpen original file
**Active version:** [`seo-geo/monitor/offsite-signal-analyzer`](https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/seo-geo/monitor/offsite-signal-analyzer) in the [`aaron-marketing-skills`](https://github.com/aaron-he-zhu/aaron-marketing-skills) bundle._The old `backlink-analyzer` was merged into `offsite-signal-analyzer` — see the mapping table for what folded where._
Show 1 other places
SKILL.md:12In the instructionsOpen original file
Install the active skill from the bundle:```npx skills add aaron-he-zhu/aaron-marketing-skills -s offsite-signal-analyzer```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 3
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install command specifies no version, tag, or commit hash, so running it at different times may retrieve different code. Although the file links to a frozen old copy, the installation instructions target an “active skill” in another repository without pinning it. A user can ask for a fixed version or commit hash and review that exact code before installation.

SKILL.md:15In the instructionsOpen original file
```npx skills add aaron-he-zhu/aaron-marketing-skills -s offsite-signal-analyzer```
Show 2 other places
SKILL.md:10In the instructionsOpen original file
**Frozen standalone copy** (unchanged, tag `v9.9.12`): [`monitor/backlink-analyzer/SKILL.md`](https://github.com/aaron-he-zhu/seo-geo-claude-skills/blob/v9.9.12/monitor/backlink-analyzer/SKILL.md).
SKILL.md:12In the instructionsOpen original file
Install the active skill from the bundle:```npx skills add aaron-he-zhu/aaron-marketing-skills -s offsite-signal-analyzer```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This is not the actual backlink-analysis skill. It says the current repository is only a signpost and directs users to `offsite-signal-analyzer` in another GitHub repository. The supplied material therefore does not show what the active skill reads, changes, or transmits.

View source
SKILL.md:4In the instructionsOpen original file
> [!IMPORTANT]> `seo-geo-claude-skills` is now a **signpost** repo — its skills are no longer developed here.> This file exists only so older links to `monitor/backlink-analyzer/` keep resolving.
SKILL.md:7In the instructionsOpen original file
**Active version:** [`seo-geo/monitor/offsite-signal-analyzer`](https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/seo-geo/monitor/offsite-signal-analyzer) in the [`aaron-marketing-skills`](https://github.com/aaron-he-zhu/aaron-marketing-skills) bundle._The old `backlink-analyzer` was merged into `offsite-signal-analyzer` — see the mapping table for what folded where._

The file also links to an older copy pinned to tag `v9.9.12`, but the source of that copy is not included in the supplied material.

View source
SKILL.md:10In the instructionsOpen original file
**Frozen standalone copy** (unchanged, tag `v9.9.12`): [`monitor/backlink-analyzer/SKILL.md`](https://github.com/aaron-he-zhu/seo-geo-claude-skills/blob/v9.9.12/monitor/backlink-analyzer/SKILL.md).
Start here · InstructionsSKILL.md
未命名 Skill
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:7In the instructionsOpen original file
**Active version:** [`seo-geo/monitor/offsite-signal-analyzer`](https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/seo-geo/monitor/offsite-signal-analyzer) in the [`aaron-marketing-skills`](https://github.com/aaron-he-zhu/aaron-marketing-skills) bundle._The old `backlink-analyzer` was merged into `offsite-signal-analyzer` — see the mapping table for what folded where._
SKILL.md:10In the instructionsOpen original file
**Frozen standalone copy** (unchanged, tag `v9.9.12`): [`monitor/backlink-analyzer/SKILL.md`](https://github.com/aaron-he-zhu/seo-geo-claude-skills/blob/v9.9.12/monitor/backlink-analyzer/SKILL.md).
SKILL.md:18In the instructionsOpen original file
Full 20 → 16 mapping: see the repo [README](https://github.com/aaron-he-zhu/seo-geo-claude-skills#readme).
Install extra software packages
SKILL.md:15In the instructionsOpen original file
```npx skills add aaron-he-zhu/aaron-marketing-skills -s offsite-signal-analyzer```
Lines read
19
File checksum (to compare versions)
069d41626c27cab66fe4c0d9d88fd12875971f3f1e9589e50985b88616c448bd