Security audit

SEO Ranker

Security checks for vulnerabilities and agentic risk

Overview

The SEO workflow is coherent, but its setup uses unpinned remote installers and updates all installed skills, which is broader than this skill needs.

Install only in an isolated environment, prefer pinned versions of the ClawHub CLI and dependencies, avoid `update --all`, expose only the API keys needed for the selected run, and do not submit confidential drafts or local files unless you are comfortable sending them to the named external providers.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:29
Finding: Mutable Third-Party Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:34
Finding: Global Update Command Modifies Unrelated Installed Skills
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:7
Finding: Over-Broad Credential Declaration and Insufficient Consent Controls for External Data Transmission
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill instructs users to execute npx -y clawhub@latest install ..., which pulls and runs the latest package version at execution time rather than a pinned, reviewed release. This creates a supply-chain risk: if the upstream package or dependency chain is compromised, users may execute attacker-controlled code locally.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This line again directs execution of npx -y clawhub@latest, causing remote package resolution and code execution from an unpinned version. Because this is an orchestration skill that requires multiple local tools and credentials, compromise of the installer path could lead to arbitrary code execution and theft of API keys from the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Using npx -y clawhub@latest install api-gateway executes whatever package version is current at the time, exposing users to package takeover or malicious update scenarios. The danger is amplified here because the installed components are intended to interact with external services and sensitive environment variables.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This installation instruction repeats the same unpinned npx pattern, allowing arbitrary newly published code to be executed on the user's machine. In the context of a skill that depends on API-backed tooling, a compromised installer could exfiltrate credentials or alter downstream tool behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: npx -y clawhub@latest update --all is especially risky because it can update multiple components in one step to unreviewed versions. This broadens the supply-chain exposure and can silently introduce malicious or breaking changes across the installed toolchain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Even the verification step uses npx -y clawhub@latest list, which still requires resolving and running the latest remote package. Although lower risk than install/update actions, it remains an unnecessary code-execution path that could be abused if the package is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill references uvx markitdown without a pinned version, which similarly resolves and executes a package/tool dynamically. While this may be operationally convenient, it introduces the same class of supply-chain risk if the package or one of its dependencies is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The reference to uvx markitdown is unpinned, so executions may resolve to whatever package version is current at runtime rather than a reviewed version. That creates a supply-chain risk: future upstream changes, compromise of the package, or breaking behavior could alter file-conversion behavior in a skill that processes untrusted content, increasing the chance of malicious parsing effects or unexpected code execution paths.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.