ClawHub
Back to skill

Security audit

vigilath-geo

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a legitimate Vigilath GEO/SEO service connector, but its installer and account features make broad local changes and persist a long-lived service token.

Review before installing. Prefer a manual or OpenClaw-native install path, use --dir to target one skills directory, and understand that authorization stores a reusable Vigilath token in ~/.vigilath/config. Treat wallet and top-up commands as account/payment-adjacent actions and only run them when explicitly intended.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill invokes shell commands, accesses environment variables, writes local files, and makes network requests, yet no permissions are declared to signal those capabilities. This creates a transparency and trust problem: users and host agents may authorize or execute the skill without understanding that it can store credentials locally and contact remote services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The advertised purpose centers on GEO/SEO analysis, but the skill also performs account authorization, local token/config management, wallet inspection, and payment/top-up flows. That mismatch can mislead users into granting access or running commands they would not expect from a content-analysis tool, increasing the risk of credential handling abuse, unintended billing actions, or local state changes.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The README directs users to execute a remote script with `curl ... | bash`, which gives unaudited network-fetched code immediate shell execution on the local machine. In the context of a GEO/SEO analysis skill, this installation mechanism is unnecessarily powerful and could install arbitrary files, alter the environment, or run malicious post-install actions if the server or delivery path is compromised.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The README says the installer writes into all detected skill directories and stores credentials on disk automatically. That behavior exceeds the narrow functional purpose of website GEO/SEO checking and increases blast radius by modifying multiple locations and persisting sensitive tokens, which could cause unintended cross-agent exposure or token leakage if filesystem permissions or directory trust boundaries are weak.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The installer performs actions beyond a narrow 'analyze GEO/SEO' function by persisting credentials and modifying agent skill directories. That broader installation behavior increases trust requirements and attack surface: if the script source or base URL is compromised, it can plant code and durable credentials on the host. In context, this is probably normal installer behavior rather than overtly malicious, but it is still security-relevant because the skill description underplays the scope of host modification.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script auto-detects several agent platforms and installs into all discovered skill directories, which is broader than least-privilege installation. This can unintentionally affect unrelated agent environments on the same machine and makes a compromised installer more powerful by enabling lateral persistence across multiple local agent runtimes.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation instructs execution of unreviewed remote shell code without a warning about system modification risk. This is dangerous because users may treat the command as routine setup for a benign analytics skill, while the command can perform arbitrary actions with the user's privileges and is difficult to audit in a pipeline form.

Vague Triggers

Medium
Confidence
79% confidence
Finding
Broad trigger phrases such as generic requests to 'check' or 'audit' a site increase the chance that the skill is invoked when the user did not intend to call an external GEO service. Mis-triggering can leak user-provided URLs or brand queries to a third-party endpoint and may unexpectedly initiate network activity or workflow branching.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The 'when to use' section casts a wide net over common business questions without sufficient exclusions, making accidental invocation more likely across normal conversation. In context, this is more dangerous because the skill can move from free checks into authenticated data access and potentially payment-adjacent workflows, so a false trigger may expose sensitive account-linked operations.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The installer stores an authentication token locally in ~/.vigilath/config, creating durable credential exposure if the account or filesystem is later compromised. Although chmod 600 reduces exposure, silently persisting a reusable token without a prominent inline warning or consent step is risky because users may not realize a long-lived secret is being written.

Session Persistence

Medium
Category
Rogue Agent
Content
for d in "${DESTS[@]}"; do say "已安装到 $d:$INSTALLED"; done

# ── ③ token + API 基址写配置(基址与下载 skill 的 host 同源,自动对齐 test/prod)──
mkdir -p "$HOME/.vigilath"
umask 077
{
  echo "# Vigilath GEO —— 机密,勿提交"
Confidence
87% confidence
Finding
mkdir -p "$HOME/.vigilath" umask 077 { echo "# Vigilath GEO —— 机密,勿提交" echo "VIGILATH_AGENT_TOKEN=$TOKEN" echo "VIGILATH_BASE=$API_BASE" } > "$HOME/.vigilath/config" chmod 600 "$HOME/.vigilath/c

External Script Fetching

High
Category
Supply Chain
Content
# Vigilath GEO skill 一行安装 —— 给对方 agent(小龙虾)drop-in。
#
#   # 免 token(推荐):终端出配对码,浏览器点一下批准即可
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash
#
#   # 只装某几个窄技能(默认装全部 7 个窄技能)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills site-audit,seo-audit
Confidence
98% confidence
Finding
curl -fsSL https://vigilath.cn/skill/install.sh | bash

External Script Fetching

High
Category
Supply Chain
Content
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash
#
#   # 只装某几个窄技能(默认装全部 7 个窄技能)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills site-audit,seo-audit
#   # 装兜底全能包(一次只肯装一个技能的宿主用这个)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills geo
#
Confidence
98% confidence
Finding
curl -fsSL https://vigilath.cn/skill/install.sh | bash

External Script Fetching

High
Category
Supply Chain
Content
#   # 只装某几个窄技能(默认装全部 7 个窄技能)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills site-audit,seo-audit
#   # 装兜底全能包(一次只肯装一个技能的宿主用这个)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills geo
#
#   # 已有 token(老方式,仍支持)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- <你的token> --base https://vigilath.cn
Confidence
98% confidence
Finding
curl -fsSL https://vigilath.cn/skill/install.sh | bash

External Script Fetching

High
Category
Supply Chain
Content
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills geo
#
#   # 已有 token(老方式,仍支持)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- <你的token> --base https://vigilath.cn
#
# 干三件事:① 把 skill 拷进探测到的 skills 目录(可多个平台同时装);
#           ② 拿到 token 写进 ~/.vigilath/config(chmod 600);③ 自检。
Confidence
98% confidence
Finding
curl -fsSL https://vigilath.cn/skill/install.sh | bash

External Script Fetching

High
Category
Supply Chain
Content
#           ② 拿到 token 写进 ~/.vigilath/config(chmod 600);③ 自检。
# 不挑框架:自动探测 OpenClaw / Claude / .agents / 当前项目,也可用 --dir 或 VIGILATH_SKILLS_DIR 指定。
#
# ★ --base 是"从哪个域名装就指向哪个域名"的关键:本脚本被 `curl | bash` 管道执行时,
#   拿不到自己的下载 URL($0 只是 "bash"),所以基址只能靠外部传入或走下面的默认值。
#   控制台「对接集成」页生成的命令会自动带上 --base <当前站点 origin>,
#   这样 test / vigilath.cn / www.vigilath.cn / www.vigilath.com.cn 全部自动对齐。
Confidence
96% confidence
Finding
curl | bash

Chaining Abuse

High
Category
Tool Misuse
Content
# Vigilath GEO skill 一行安装 —— 给对方 agent(小龙虾)drop-in。
#
#   # 免 token(推荐):终端出配对码,浏览器点一下批准即可
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash
#
#   # 只装某几个窄技能(默认装全部 7 个窄技能)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills site-audit,seo-audit
Confidence
95% confidence
Finding
| bash

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.