ClawHub
Back to skill

Security audit

seo-seranking

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a normal SE Ranking SEO helper, but it tells the agent to inspect a Claude settings file that may contain unrelated secrets.

Review before installing. The main risk is that the skill directs the agent to open ~/.claude/settings.json to check for one API key, which could expose unrelated local configuration or secrets to the agent context. Prefer a version that checks only whether SERANKING_API_KEY is available in the environment and includes auditable installer scripts.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:12
Finding

Unnecessary Access to Sensitive Agent Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–16
Vulnerability Type: Excessive access to agent configuration and potentially unrelated credentials
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Prerequisites

- Run `extensions/seranking/install.sh` (or `install.ps1`).
- An SE Ranking API key (https://seranking.com/api.html).
- Before any call, verify `SERANKING_API_KEY` is present in `~/.claude/settings.json` under `env.`. If absent, tell the user to run the installer.

Technical Analysis

The skill directs the agent to inspect the user-level ~/.claude/settings.json file merely to determine whether SERANKING_API_KEY is configured. This file may contain unrelated environment variables, credentials, MCP server configuration, and other sensitive agent settings.

Reading the complete configuration file violates the principle of least privilege because the task only requires a Boolean determination of whether one environment variable is available. The check can instead be performed against the process environment without opening or displaying the underlying settings file.

The referenced extensions/seranking/install.sh and install.ps1 files are not present in the audited project. Consequently, their installation behavior, credential handling, and file permissions could not be verified. This absence does not establish malicious behavior, but it prevents validation of the setup process referenced by the skill.

Attack Path

  1. A user invokes an SE Ranking command defined by the skill.
  2. The agent follows the prerequisite instruction and reads ~/.claude/settings.json.
  3. The contents of unrelated configuration fields and secrets may enter the agent's working context or tool logs.
  4. A subsequent prompt-injection payload, unsafe diagnostic response, or overly broad tool operation could cause those values to be disclosed or reused outside their intended scope.

This ...[truncated 817 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the instruction to read ~/.claude/settings.json with a narrowly scoped environment check that tests only whether SERANKING_API_KEY is defined.
  2. Ensure the check never prints, logs, interpolates, or returns the API key value. It should report only whether the variable is present.
  3. Explicitly instruct the agent not to inspect complete settings files or enumerate unrelated environment variables.
  4. Include the referenced installation scripts in the distributed project so their behavior can be audited, or provide transparent manual setup instructions that do not require executing unavailable code.
  5. Ensure any installer stores credentials with restrictive file permissions and avoids exposing values through command history, process arguments, console output, or logs.
  6. Add a credential-redaction requirement for all diagnostics and error messages associated with SE Ranking API requests.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- Run `extensions/seranking/install.sh` (or `install.ps1`).
- An SE Ranking API key (https://seranking.com/api.html).
- Before any call, verify `SERANKING_API_KEY` is present in `~/.claude/settings.json` under `env.`. If absent, tell the user to run the installer.

## Routing

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest description at L03 presents the skill as an 'AI visibility analyst' focused on Share-of-Voice across AI platforms. However, the documented routing section adds broader SEO capabilities including SERP tracking, backlink profiling, and competitor analysis, which materially exceed the narrow description rather than serving as obvious implementation details of AI visibility analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The phrase "Google AI Mode (US English first)" indicates a locale preference in the skill's documented behavior. The file does not offer a user choice or opt-in for locale, which can conflict with language/locale policy requirements.

Content

No source excerpt is available for this finding.