ClawHub
Back to skill

Security audit

Technical Seo Checker

Security checks across malware telemetry and agentic risk

Overview

This skill is a technical SEO audit guide with disclosed, purpose-aligned web checks and an optional gated index-submission helper after fixes.

Before installing, understand that most use is read-only SEO auditing, but live index submission should only be used when you own or administer the site, have the proper IndexNow or Baidu credentials, and explicitly want URLs submitted after fixes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill is framed as an audit/checker, but it also documents a write-capable action that submits URLs to external indexing endpoints. That expands the trust boundary from passive analysis to state-changing operations against third-party services, which can cause unintended submissions, ownership misuse, or policy violations if an agent invokes it without explicit user approval.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
A checker/audit skill should primarily observe and report, but this skill advertises the ability to push URLs to search engines. Even though the text says the helper is gated and dry-run by default, including mutation behavior in the same skill increases the chance that an agent performs external actions during what the user expected to be a read-only assessment.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:104