Ahrefs Complete SEO Suite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:30 PM UTC
• Version: 1.2.0

Overview

The skill is a legitimate Ahrefs SEO helper, but its setup and examples can expose the user's Ahrefs API token and send it to unintended places.

Review before installing. Use a dedicated Ahrefs API token with the minimum needed permissions, avoid pasting real tokens into shell commands, do not run the documented grep commands that print .env contents, and replace relative JavaScript fetch examples with explicit https://api.ahrefs.com/v3 URLs before reuse. Treat submitted domains, URLs, and keywords as data shared with Ahrefs, especially in batch mode.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: INSTALL.md:32

Finding

Ahrefs API Token Exposed Through Shell History and Terminal Output

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md:32-41, 56, 94-95; README.md:81-94; SKILL.md:25-33
Vulnerability Type: Insecure credential handling and plaintext secret disclosure
Risk Level: Medium

Vulnerable Code

INSTALL.md:32-41:

bash

Add your API credentials to `~/.openclaw/workspace/.env`:

# Linux/Mac
echo "AHREFS_API_TOKEN=your_token_here" >> ~/.openclaw/workspace/.env
echo "AHREFS_API_PLAN=enterprise" >> ~/.openclaw/workspace/.env

# Windows (PowerShell)
Add-Content -Path "$env:USERPROFILE\.openclaw\workspace\.env" -Value "AHREFS_API_TOKEN=your_token_here"
Add-Content -Path "$env:USERPROFILE\.openclaw\workspace\.env" -Value "AHREFS_API_PLAN=enterprise"

INSTALL.md:56 and INSTALL.md:94-95:

bash

grep AHREFS ~/.openclaw/workspace/.env

bash

# Verify token is set correctly
grep AHREFS_API_TOKEN ~/.openclaw/workspace/.env

README.md:81-94:

bash

Add your Ahrefs API credentials to `~/.openclaw/workspace/.env`:

# Required
AHREFS_API_TOKEN=your_api_token_here

# Required - Specify your plan tier
AHREFS_API_PLAN=enterprise  # Options: lite, standard, advanced, enterprise

### Verify Setup

grep AHREFS ~/.openclaw/workspace/.env

SKILL.md:25-33:

bash

Add to `~/.openclaw/workspace/.env`:

AHREFS_API_TOKEN=your_api_token_here
AHREFS_API_PLAN=enterprise  # Options: lite, standard, advanced, enterprise

# Verify setup
grep AHREFS ~/.openclaw/workspace/.env

Technical Analysis

The installation instructions encourage users to substitute a real bearer token directly into an echo or PowerShell Add-Content command. The complete command, including the secret, can remain in shell history and may also be captured by terminal recording, audit instrumentation, process monitoring, CI logs, or Agent execution logs.

The verification commands then print the token-bearing line from the shared workspace .env file. ...[truncated 1634 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not ask users to place real secrets directly in shell command arguments.

2. Prefer the OpenClaw secret-management facility or an operating-system credential store where available.

3. If a file must be used, collect the token through hidden interactive input and write it without echoing it:

   bash

   read -rsp "Ahrefs API token: " AHREFS_TOKEN
   printf '\n'
   umask 077
   printf 'AHREFS_API_TOKEN=%s\n' "$AHREFS_TOKEN" >> ~/.openclaw/workspace/.env
   unset AHREFS_TOKEN
   

4. Ensure the credential file is created with owner-only permissions rather than correcting permissions only after the secret has been written:

   bash

   install -m 600 /dev/null ~/.openclaw/workspace/.env
   

5. Replace token-printing verification commands with checks that disclose only status:

   bash

   if grep -q '^AHREFS_API_TOKEN=.\+' ~/.openclaw/workspace/.env; then
     echo "AHREFS_API_TOKEN is configured"
   else
     echo "AHREFS_API_TOKEN is missing"
   fi
   

6. Avoid logging request headers and redact Authorization values in Agent, CI, debugging, and support output.

7. Recommend rotating the API token if it has already appeared in command history or logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/batch-analysis.md:267

Finding

Relative Fetch URLs Can Disclose the Ahrefs Bearer Token to an Unintended Origin

Content

View full analysis

Vulnerability Details

File Location: references/batch-analysis.md:267-320
Vulnerability Type: Credential exfiltration through origin-relative authenticated requests
Risk Level: Medium

Vulnerable Code

javascript

// Analyze 50 competitors at once
const competitors = [
  'competitor1.com',
  'competitor2.com',
  // ... up to 100
];

fetch('/site-explorer/batch/metrics', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + token,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    targets: competitors,
    date: '2026-02-18',
    select: 'org_keywords,org_traffic,domain_rating'
  })
});

// Analyze all target keywords
const keywords = readKeywordsFromFile(); // Up to 100

fetch('/keywords-explorer/batch/overview', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + token,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    keywords: keywords,
    country: 'us'
  })
});

// Analyze all important pages
const urls = [
  'https://example.com/page1',
  'https://example.com/page2',
  // ... all key pages
];

fetch('/site-explorer/batch/url-metrics', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + token,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    urls: urls,
    date: '2026-02-18'
  })
});

Technical Analysis

Each example attaches the Ahrefs bearer token to an origin-relative URL. In browsers and similar JavaScript environments, a URL beginning with / resolves against the current document or runtime origin. The requests therefore do not inherently target the documented https://api.ahrefs.com/v3/ endpoint.

Merely documenting a base URL earlier in the file does not configure fetch() to use that base URL. If a user copies the examples into a web page, dashboard, development environment, or application hosted ...[truncated 1493 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace all relative destinations with explicit Ahrefs HTTPS URLs:

   javascript

   const AHREFS_API_ORIGIN = 'https://api.ahrefs.com';
   const endpoint = new URL(
     '/v3/site-explorer/batch/metrics',
     AHREFS_API_ORIGIN
   );
   
   if (endpoint.origin !== AHREFS_API_ORIGIN) {
     throw new Error('Refusing to send credentials to an untrusted origin');
   }
   
   fetch(endpoint, {
     method: 'POST',
     headers: {
       Authorization: `Bearer ${token}`,
       'Content-Type': 'application/json'
     },
     body: JSON.stringify({
       targets: competitors,
       date: '2026-02-18',
       select: 'org_keywords,org_traffic,domain_rating'
     })
   });
   

2. Apply the same absolute-origin construction to the keyword and URL batch examples.

3. Validate the final URL immediately before adding the Authorization header.

4. Do not allow user-controlled input to override the scheme, host, or port of authenticated destinations.

5. Prefer server-side API calls so long-lived Ahrefs tokens are not exposed to browser JavaScript.

6. If browser execution is unavoidable, use a narrowly scoped backend proxy that keeps the Ahrefs credential server-side and validates allowed operations.

7. Redact authorization headers from reverse-proxy, application, and debugging logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (103)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 36)May include surrounding context.

bash

# Linux/Mac
echo "AHREFS_API_TOKEN=your_token_here" >> ~/.openclaw/workspace/.env
echo "AHREFS_API_PLAN=enterprise" >> ~/.openclaw/workspace/.env

# Windows (PowerShell)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 37)May include surrounding context.

bash

# Linux/Mac
echo "AHREFS_API_TOKEN=your_token_here" >> ~/.openclaw/workspace/.env
echo "AHREFS_API_PLAN=enterprise" >> ~/.openclaw/workspace/.env

# Windows (PowerShell)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 113)May include surrounding context.

bash

# Linux/Mac
echo "AHREFS_API_TOKEN=your_token_here" >> ~/.openclaw/workspace/.env
echo "AHREFS_API_PLAN=enterprise" >> ~/.openclaw/workspace/.env

# Windows (PowerShell)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 136)May include surrounding context.

bash

# Linux/Mac
echo "AHREFS_API_TOKEN=your_token_here" >> ~/.openclaw/workspace/.env
echo "AHREFS_API_PLAN=enterprise" >> ~/.openclaw/workspace/.env

# Windows (PowerShell)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · UPDATE_SUMMARY.md (reported line 156)May include surrounding context.

bash

# Linux/Mac
echo "AHREFS_API_TOKEN=your_token_here" >> ~/.openclaw/workspace/.env
echo "AHREFS_API_PLAN=enterprise" >> ~/.openclaw/workspace/.env

# Windows (PowerShell)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 40)May include surrounding context.

echo "AHREFS_API_PLAN=enterprise" >> ~/.openclaw/workspace/.env

Windows (PowerShell)

Add-Content -Path "$env:USERPROFILE.openclaw\workspace.env" -Value "AHREFS_API_TOKEN=your_token_here" Add-Content -Path "$env:USERPROFILE.openclaw\workspace.env" -Value "AHREFS_API_PLAN=enterprise"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 41)May include surrounding context.

echo "AHREFS_API_PLAN=enterprise" >> ~/.openclaw/workspace/.env

Windows (PowerShell)

Add-Content -Path "$env:USERPROFILE.openclaw\workspace.env" -Value "AHREFS_API_TOKEN=your_token_here" Add-Content -Path "$env:USERPROFILE.openclaw\workspace.env" -Value "AHREFS_API_PLAN=enterprise"

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The config check explicitly instructs users to print matching Ahrefs variables from the .env file, which will expose the secret API token in plaintext on screen. In a troubleshooting or demo context, that token can be captured by logs, shoulder-surfing, terminal recording, or copied into support channels.

Content

Scanner excerpt · INSTALL.md (reported line 56)May include surrounding context.

bash

# Check config
grep AHREFS ~/.openclaw/workspace/.env

# Test the skill
openclaw agent --message "Get domain rating for ahrefs.com"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The troubleshooting instruction grep AHREFS_API_TOKEN ~/.openclaw/workspace/.env prints the full token value, directly exposing a live API credential. Because this is presented as a support/debugging step, users are especially likely to copy and share the output, making accidental compromise plausible.

Content

Scanner excerpt · INSTALL.md (reported line 95)May include surrounding context.

bash

# Verify token is set correctly
grep AHREFS_API_TOKEN ~/.openclaw/workspace/.env

# Test manually
curl -H "Authorization: Bearer YOUR_TOKEN" \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The verification step tells users to run grep against the .env file, which will print the Ahrefs secret to the terminal. Displaying credentials in shell output increases the chance of exposure through terminal history, screen sharing, logs, clipboard capture, or shoulder surfing.

Content

Scanner excerpt · README.md (reported line 94)May include surrounding context.

Verify Setup

bash

grep AHREFS ~/.openclaw/workspace/.env

Usage Examples

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Telling users to verify setup by grepping the workspace .env file encourages direct access to a secret store and may expose the presence or value of credentials in shells, logs, or agent-visible output. In an LLM-agent context, prompting any file read of secret material is especially risky because the model may surface or reuse that data beyond the original purpose.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

3. Verify setup:

   bash

   grep AHREFS ~/.openclaw/workspace/.env
   

Plan-Specific Features

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The PowerShell example instructs reading and parsing the workspace .env file to extract the API token, which is a direct credential-access pattern. This materially increases the chance of secret exposure through command history, process inspection, logs, or agent responses, and exceeds the least-privilege needs of an SEO skill.

Content

Scanner excerpt · SKILL.md (reported line 349)May include surrounding context.

Load the token from the workspace .env file:

powershell

# PowerShell
$env:AHREFS_API_TOKEN = (Get-Content ~/.openclaw/workspace/.env -Raw | Select-String "AHREFS_API_TOKEN=([^\r\n]+)" | ForEach-Object { $_.Matches.Groups[1].Value })

bash

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The Bash example uses grep on the workspace .env file to export the token, directly teaching credential extraction from a local secret file. In agent environments this creates a clear pathway for overbroad local file access and accidental or intentional leakage of API credentials.

Content

Scanner excerpt · SKILL.md (reported line 354)May include surrounding context.

bash

# Bash
export AHREFS_API_TOKEN=$(grep AHREFS_API_TOKEN ~/.openclaw/workspace/.env | cut -d'=' -f2)

Response Format

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The verification step tells users to run grep AHREFS ~/.openclaw/workspace/.env, which will print the full Ahrefs token to the terminal and potentially into shell history, terminal scrollback, screen recordings, or shared support sessions. In an installation guide for an API-backed skill, this creates an avoidable secret exposure risk even though the command is meant for troubleshooting.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 113)May include surrounding context.

Ensure .env file is readable:

bash

chmod 600 ~/.openclaw/workspace/.env

Upgrading

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README directs users to place a live Ahrefs API token in a plaintext .env file but gives no guidance on securing that file, excluding it from version control, or avoiding disclosure in logs and screenshots. This can lead to accidental credential leakage, especially in shared workspaces or when users are unfamiliar with secret-handling practices.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill for 'any SEO-related queries,' which is broader than the narrowly scoped actions needed for a specific API integration. Overly broad invocation criteria can cause the skill to trigger in more contexts than necessary, increasing the odds of unnecessary secret use or external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The setup section tells users to place an API token in .env and discusses authentication handling, but it does not warn that the token is sensitive or that it must never be exposed in logs, responses, or prompts. In a prompt-driven agent environment, omission of credential-handling safeguards materially raises the risk of accidental disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Site Explorer - Get Backlinks & Referring Domains

bash

DATE=$(date +%Y-%m-%d)
curl -X GET "https://api.ahrefs.com/v3/site-explorer/backlinks-stats?date=$DATE&target=example.com" \
  -H "Authorization: Bearer $AHREFS_API_TOKEN"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to read the API token directly from the workspace .env file at runtime, which normalizes secret-file access beyond the minimum needed for SEO queries. In an agent setting, this increases the chance that the model or downstream tooling will access local credentials and potentially mishandle or expose them.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · UPDATE_SUMMARY.md (reported line 88)May include surrounding context.

git push origin main --tags

text

### 2. Create GitHub Release

1. Go to your GitHub repository
2. Click "Releases" → "Create a new release"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This reference encourages bulk submission of domains, URLs, and keywords to a third-party API but does not warn that those inputs may contain sensitive business intelligence, customer URLs, internal staging hosts, or confidential keyword strategy. In an agent skill context, users may provide proprietary target lists at scale, increasing the chance of unintended external disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This example transmits target domains and an API token to an external endpoint. In the context of a batch-analysis skill, the danger is not the existence of network access itself but the lack of caution around sending large sets of potentially sensitive business data in one request.

Content

Scanner excerpt · references/batch-analysis.md (reported line 32)May include surrounding context.

Example:

bash

curl -X POST "https://api.ahrefs.com/v3/site-explorer/batch/metrics" \
  -H "Authorization: Bearer $AHREFS_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This example transmits target domains and an API token to an external endpoint. In the context of a batch-analysis skill, the danger is not the existence of network access itself but the lack of caution around sending large sets of potentially sensitive business data in one request.

Content

Scanner excerpt · references/batch-analysis.md (reported line 32)May include surrounding context.

Example:

bash

curl -X POST "https://api.ahrefs.com/v3/site-explorer/batch/metrics" \
  -H "Authorization: Bearer $AHREFS_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The backlink-stats batch example sends multiple domains to a third-party service, which can expose confidential competitor tracking lists or customer portfolios if used carelessly. Because batch mode scales to 100 targets, the accidental disclosure impact is amplified.

Content

Scanner excerpt · references/batch-analysis.md (reported line 80)May include surrounding context.

Example:

bash

curl -X POST "https://api.ahrefs.com/v3/site-explorer/batch/backlinks-stats" \
  -H "Authorization: Bearer $AHREFS_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.