ClawHub
Back to skill

Security audit

seo-seranking

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward SE Ranking API helper, but users should be aware it uses an external API and asks the agent to check a local Claude settings file for an API key.

Install only if you are comfortable sending SEO queries, brands, keywords, URLs, and backlink targets to SE Ranking. Avoid placing unrelated secrets in files the agent may inspect, and prefer a narrow API-key presence check rather than exposing full settings contents.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs users to submit brands, keywords, URLs, and backlink targets to the SE Ranking API but does not disclose that these user-supplied inputs are transmitted to a third-party service. This creates a privacy and data-handling risk because users may provide sensitive business intelligence, internal URLs, or customer-related targets without informed consent.

Agent Config Directory Access

High
Category
Agent Snooping
Content
- Run `extensions/seranking/install.sh` (or `install.ps1`).
- An SE Ranking API key (https://seranking.com/api.html).
- Before any call, verify `SERANKING_API_KEY` is present in `~/.claude/settings.json` under `env.`. If absent, tell the user to run the installer.

## Routing
Confidence
92% confidence
Finding
~/.claude/settings.json

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.