Ahrefs Complete SEO Suite

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward Ahrefs API instruction skill, but it requires an Ahrefs token and can consume paid API quota.

Before installing, make sure you are comfortable giving the agent access to your Ahrefs API token and quota. Use a rotatable token, keep the .env file private, avoid printing or sharing the token, and confirm before running broad or batch analyses that may consume many API units.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The agent can use your Ahrefs API access and allowance for SEO requests, and the token could be exposed if terminal output or logs are shared.

Why it was flagged

The skill requires a persistent Ahrefs API token and suggests a verification command that can display it; this is expected for Ahrefs API access but is still an account credential.

Skill content

echo "AHREFS_API_TOKEN=your_token_here" >> ~/.openclaw/workspace/.env ... grep AHREFS ~/.openclaw/workspace/.env

Recommendation

Store the token only in the workspace .env file with restrictive permissions, avoid printing the full token, and rotate/revoke it if it is exposed.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Large or repeated SEO queries could use up Ahrefs API units or hit rate limits.

Why it was flagged

The skill is designed to call Ahrefs APIs, including bulk and large-result queries, which can consume the user's paid API quota.

Skill content

Each API request consumes units from your monthly allowance ... Cost depends on rows returned (minimum 50 units per request)

Recommendation

Set clear limits for broad or batch requests, use small result limits when possible, and review API usage in Ahrefs after large analyses.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a user manually clones an untrusted repository, they could install different content than the reviewed instruction-only skill.

Why it was flagged

The optional manual installation path uses an unspecified repository placeholder, so provenance depends on what URL the user chooses. The provided artifacts themselves contain no runnable code.

Skill content

git clone <repo-url> ahrefs

Recommendation

Install from the official ClawHub/OpenClaw listing when possible, or verify the repository owner and commit before manual installation.