ClawHub
Back to skill

Security audit

TinkerClaw Backlink Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed backlink-auditing tool whose network use, optional API key handling, and opt-in local writes match its stated purpose.

Install only if you want a backlink classifier that may use GitHub CLI auth or a backlinks.sh API key. Prefer the offline urls or gsc-csv sources when possible, review and replace the shipped allowlist and build-history example data with your own, and use --write-state or build-history.mjs --yes only when you intend to update your OpenClaw state/control-panel data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (74)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/sources.md (reported line 15)May include surrounding context.

md
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/backlink-audit.mjs (reported line 87)May include surrounding context.

js
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/backlink-audit.mjs (reported line 94)May include surrounding context.

js
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test-credentials.sh (reported line 19)May include surrounding context.

sh
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test-credentials.sh (reported line 72)May include surrounding context.

sh
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test-credentials.sh (reported line 86)May include surrounding context.

sh
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test-credentials.sh (reported line 102)May include surrounding context.

sh
requires:
      bins: ["node"]
    notes:
      security: "A read-mostly link classifier. Two of its four sources (urls, gsc-csv) make no network call at all; `github` shells out to the `gh` CLI you already authenticated, and `backlinks` is the only one that uses a credential — a backlinks.sh API key, resolved from BACKLINKS_SH_API_KEY (transient) or the OS keychain (secret-tool/security) — and from nowhere else. There is NO plaintext fallback: if no keychain is available `--login` refuses and writes nothing, rather than silently downgrading a long-lived API key to a file on disk. A credentials.json left by an older version is detected and explained but never read as a credential, and `--logout` still deletes it. The key reaches the keychain on stdin on both platforms (macOS uses `security -i` so it is never an argv element visible in `ps`); `--logout` prints where to revoke it server-side. Nothing is written outside the skill folder unless you pass a flag: `--write-state` updates one JSON file under ~/.openclaw, and scripts/build-history.mjs writes to your control-panel store only with --yes (bare, it is a dry run). No telemetry, no third-party endpoint beyond api.backlinks.sh, no source-tree patching, no privilege escalation. See the Permissions, Data Flow & Consent section."
    # Declared capabilities. Each is used for exactly the reason given; anything not
    # listed here, the skill does not do.
    permissions:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
, (2) match each source against surfaces you control. This skill does both via `scripts/backlink-audit.mjs` and an editable allowlist.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
, (2) match each source against surfaces you control. This skill does both via `scripts/backlink-audit.mjs` and an editable allowlist.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
, (2) match each source against surfaces you control. This skill does both via `scripts/backlink-audit.mjs` and an editable allowlist.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
, (2) match each source against surfaces you control. This skill does both via `scripts/backlink-audit.mjs` and an editable allowlist.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
Read `references/sources.md` before picking — it has the auth setup, the backlinks.sh signup/limits, how to export the GSC CSV, and the per-source caveats.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
Read `references/sources.md` before picking — it has the auth setup, the backlinks.sh signup/limits, how to export the GSC CSV, and the per-source caveats.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
#!/usr/bin/env bash
# Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere.
#
# Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So
# every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
#!/usr/bin/env bash
# Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere.
#
# Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So
# every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
#!/usr/bin/env bash
# Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere.
#
# Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So
# every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
#!/usr/bin/env bash
# Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere.
#
# Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So
# every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
#!/usr/bin/env bash
# Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere.
#
# Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So
# every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
#!/usr/bin/env bash
# Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere.
#
# Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So
# every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/sources.md (reported line 17)May include surrounding context.

md
#!/usr/bin/env bash
# Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere.
#
# Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So
# every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/backlink-audit.mjs (reported line 21)May include surrounding context.

js
#!/usr/bin/env bash
# Focused tests: the backlinks.sh API key lives in the OS keychain or nowhere.
#
# Isolation: redirecting HOME is NOT enough — the OS keychain is not under HOME. So
# every run puts stub `secret-tool` and `security` executables first on PATH. The stubs

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/backlink-audit.mjs:153