ClawHub
Back to skill

Security audit

Geo Opt Coordinator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed coordinator for a GEO optimization SaaS, with expected API-key handling but no hidden executable behavior.

Install this only if you intend to connect your agent to the GEO optimization service at ai.gaobobo.cn. Treat the GEO key like a password, keep the local key file private, rotate or revoke it if exposed, and review the separate geo-cycle-autopilot and geo-mass-publish-check skills before enabling scheduled automation or publishing-related workflows.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to read or request a secret key, verify it via a remote API, and then save it to a local file under the user's home directory, but it provides no user-facing warning about secret handling, file permissions, or exposure risks. This creates credential-handling risk because users may disclose secrets in chat, and locally stored API keys may be left accessible to other processes or users if not protected properly.

Static analysis

No suspicious patterns detected.