ClawHub
Back to skill

Security audit

Seo Reporter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SEO audit tool, but it can make unrestricted live HTTP requests to arbitrary user-supplied URLs from the agent environment.

Install only if you are comfortable with the agent making live HTTP requests from its own environment. Use it on URLs you trust, avoid attacker-supplied or internal URLs, and prefer adding URL validation or network egress controls before using it in sensitive or cloud-hosted environments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
audit.sh:48
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
/dev/null || echo "000") ``` Additional requests are derived from the user-controlled target host: ```bash ROBOTS_STATUS_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$ROBOTS_URL" 2>/dev/null || echo "000") ROBOTS_CONTENT=$(curl -s --max-time 10 "$ROBOTS_URL" 2>/dev/null || echo "") ``` ```bash SITEMAP_STATUS_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$SITEMAP_URL" 2>/dev/null || echo "000") SITEMAP_CONTENT=$(curl -s --max-time 15 "$SITEMAP_URL" 2>/dev/null || echo "") ``` ```bash SITEMAP_ALTS=( "${BASE_URL}/sitemap-index.xml" "${BASE_URL}/sitemap_index.xml" "${BASE_URL}/sitemap/index.xml" ) FOUND_SITEMAP="" for ALT in "${SITEMAP_ALTS[@]}"; do if [[ $(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$ALT" 2>/dev/null || echo "000") == "200" ]]; then FOUND_SITEMAP="$ALT" break fi done ``` ### Technical Analysis The script accepts an arbitrary URL and validates only whether it begins with `http://` or `https://`. It does not parse and validate the destination host, resolve the host before making the request, or reject loopback, private, link-local, reserved, multicast, and cloud metadata addresses. The initial request also uses `curl -L`, which follows redirects. Consequently, even if a public destination were validated, that destination could redirect the request to an internal address unless every redirect target were independen ...[truncated 1983 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes shell execution via ./audit.sh and requires curl, but it does not declare any explicit tool scope such as permissions or allowed-tools. That increases the chance an agent will run shell commands with broader-than-necessary authority, weakening least-privilege controls and making misuse of the skill harder to contain if the script or its inputs are unsafe.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says to use the skill when asked to "analyze, check, or audit a webpage's SEO performance," and terms like "analyze" or "check" are broad enough to collide with general webpage review requests. Although later examples add context, the manifest description is itself a likely activation source and does not tightly constrain the trigger scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · audit.sh (reported line 61)May include surrounding context.

sh
log "Auditing: ${TARGET_URL}"

# ── Fetch ─────────────────────────────────────────────────────────────────────
HTTP_CODE=$(curl -s -o "$HTML" -D "$HEADERS" -L -A "seo-reporter/1.0" \
  -w "%{http_code}" --max-time 20 "$TARGET_URL" 2>/dev/null || echo "000")

if [[ "$HTTP_CODE" == "000" ]]; then

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This shell script performs outbound HTTP requests to the provided site and later to derived endpoints such as /robots.txt and /sitemap.xml. Although the script logs that it is auditing a URL, it does not explicitly warn that the supplied URL will be transmitted to remote servers as part of the audit activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.