ClawHub
Back to skill

Security audit

seo-compliance-checker

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Chinese SEO compliance tool, but it can send user content to an external API without clear privacy/consent safeguards and has an unsafe keyword-handling bug.

Install only if you are comfortable sending Chinese marketing drafts, titles, keywords, product claims, and similar content to the listed external API. Avoid confidential customer data, unreleased campaigns, regulated business material, or sensitive internal copy unless the publisher provides acceptable privacy and retention terms. Treat suggestions.sh cautiously until its keyword URL-encoding is fixed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger set is very broad, including generic phrases like SEO checker, compliance checker, and Chinese SEO, which can cause the skill to activate for ordinary writing or review requests outside its narrow intended use. Because the skill also encourages API-backed scanning and shell-script usage, over-invocation increases the chance of unnecessary external data disclosure and unintended tool execution.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly routes user-provided content to a real-time third-party API but does not prominently disclose privacy, retention, jurisdiction, or sensitivity risks. Users may paste drafts, marketing plans, customer data, or regulated content believing analysis is local, leading to unauthorized external transmission.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script transmits arbitrary user-supplied text, and optionally title/keywords, to a remote API without an explicit privacy warning or consent step. Because this tool is likely to be used on draft marketing copy, product claims, or other potentially sensitive business content, silent exfiltration to a third-party service creates a real confidentiality risk even if the feature is nominally expected.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends the user-provided keyword to a remote third-party API endpoint without any explicit disclosure at execution time. In the context of a content-compliance tool, users may paste draft ad copy, product claims, or sensitive business terms, so silent transmission creates a real privacy and data-handling risk even if the feature is functionally expected.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.