ClawHub
Back to skill

Security audit

Webflow SEO/GEO + API

Security checks for vulnerabilities and agentic risk

Overview

This Webflow SEO skill is coherent and not malicious, but it should be reviewed because it directs agents to update and publish CMS content through an API without an explicit approval or staging safeguard.

Install only if you are comfortable with an agent preparing and applying Webflow CMS changes. Before using it, require a manual review before any publish call, prefer a staging or draft workflow first, use a least-privilege Webflow token, and keep generated /out/ patch files under review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs publishing CMS changes via the Webflow API and then publishing them live, but does not warn that this will modify production content. In a content-management skill, this creates a real risk of unintended live-site changes, defacement, SEO regressions, or accidental publication of draft content if a user runs the workflow without adequate review.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The document prescribes copywriting patterns entirely in French, including French title templates, meta-description guidance, and CTA examples. This can violate a language/locale policy if the skill is used in broader contexts because it mandates a specific language without stating that French is optional or user-selected.

External Transmission

Medium
Category
Data Exfiltration
Content
# Webflow API v2 — quick reference (JSS)

Base: https://api.webflow.com/v2
Auth: Bearer $WEBFLOW_API_TOKEN
Headers: Content-Type: application/json; Accept-Version: 2.0.0
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
81% confidence
Finding
Writing patch payloads to a local `/out/` folder affects user data on disk, but the markdown offers no disclosure about where files are written, potential overwrites, or reviewing generated patches. For a skill description, a brief warning is expected when user data or local files are modified.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill tells users to use a Webflow API token but provides no guidance on secure handling of that credential. Although this is common documentation shorthand, omission of basic token-safety guidance can lead to leakage through logs, shell history, screenshots, committed files, or insecure environment management, enabling unauthorized CMS modifications.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The example JSON uses French field names such as "contenu-de-l-article", "image-de-couverture", and "date-de-redaction" without any note that the template is French-specific or intended for a particular locale. This can violate the language/locale policy because it implicitly forces a specific language convention without user opt-in or documented justification.

Static analysis

No suspicious patterns detected.