ClawHub
Back to skill

Security audit

ai-seo

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only AI SEO skill that gives site-publishing advice, with cautions needed around AI crawler exposure and a third-party WordPress plugin recommendation.

Installers should treat this as marketing and publishing guidance, not an automated tool. Before allowing AI bots, confirm the content is public and non-sensitive and review each crawler's current policy. Avoid installing the referenced WordPress plugin in production unless you can verify its source, version, checksum, and behavior, preferably in staging first.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/okf.md:68
Finding

Unverified Third-Party WordPress Plugin Recommendation

Content
View full analysis

Vulnerability Details

File Location: references/okf.md, lines 68–73
Vulnerability Type: Supply-chain risk from an unverified third-party plugin
Risk Level: Medium

Vulnerable Content

markdown
### 1. Suganthan's free web tool (recommended for most sites)

[suganthan.com/okf-generator](https://suganthan.com/okf-generator/) — paste a URL or sitemap, crawls up to 100 pages, returns a downloadable bundle. Also draws the resulting page graph so you can spot disconnected pages before publishing.

### 2. WordPress plugin (pending wp.org approval)

Suganthan's plugin (free, GPL, awaiting wp.org approval at time of writing) installs in a minute, serves the bundle at `/okf/`, and rebuilds on every publish or edit so it stays in sync. Direct download link is in [his blog post](https://suganthan.com/blog/open-knowledge-format/). Requires WordPress 6.0+ and PHP 7.4+. Read-only — never edits posts or settings.

Technical Analysis

The Skill recommends installing a WordPress plugin distributed through a personal website while explicitly stating that the plugin is awaiting approval by the official WordPress plugin repository. It provides no pinned version, immutable source commit, cryptographic checksum, digital signature, or independent source-review procedure.

This creates a supply-chain trust boundary: the plugin archive or the linked page can change after the Skill has been audited. Although the project itself does not download or execute the plugin automatically, users following its implementation guidance may install mutable third-party PHP code into a privileged web application.

The statement that the plugin is “read-only” is not independently substantiated within the project and should not be treated as a security guarantee.

Attack Path

  1. A user follows the Skill’s recommended OKF implementation guidance.
  2. The user visits the linked personal website or blog post.
  3. The external site, download link, hosting account, or plugin ...[truncated 1194 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not recommend direct installation from a mutable personal-site download while official repository review remains pending.
  2. Prefer distribution through the official WordPress plugin repository after approval.
  3. If pre-approval use is unavoidable:
    • Link to a specific, immutable source commit and tagged release.
    • Publish and verify a SHA-256 checksum for the exact archive.
    • Require review of the plugin source and dependencies before activation.
    • Verify that the plugin performs only documented read operations and cannot modify posts, settings, users, or executable files.
  4. Install and test the plugin in an isolated staging environment before production deployment.
  5. Back up the database and filesystem before installation.
  6. Run WordPress and PHP under least-privilege accounts, restrict filesystem write access, and minimize database grants.
  7. Add explicit wording that third-party plugins execute server-side code and that “read-only” claims require independent verification.
  8. Offer manual OKF bundle generation as the default alternative until a verifiable package is available.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document explicitly encourages allowing multiple AI crawlers and acknowledges that GPTBot may support both citation and model training, but it frames this mainly as an SEO tactic rather than a meaningful data-governance decision. That can mislead operators into exposing proprietary, licensed, or privacy-sensitive site content to third-party ingestion without a prominent warning about the tradeoff.

Content

No source excerpt is available for this finding.