Rankscale Geo Analytics

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:31 AM UTC
• Version: 1.0.11

Overview

This is a coherent Rankscale analytics skill, but it needs review because one error path can print the full API key into logs.

Review before installing. Use this only if you are comfortable connecting a Rankscale account and exposing brand analytics to the Rankscale API. Configure the API key through OpenClaw Gateway or a secret manager when possible, avoid passing it with --api-key, make sure .env is ignored by version control, and rotate the key if it may have appeared in terminal or gateway logs. Invoke the skill with explicit Rankscale wording to reduce accidental runs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: rankscale-skill.js:2154

Finding

Rankscale API Key Exposed in Error Output

Content

View full analysis

Vulnerability Details

File Location: rankscale-skill.js:2154-2157
Vulnerability Type: Sensitive credential exposure through stderr logging
Risk Level: Medium

Vulnerable Code

js

console.error(
  `  RANKSCALE_API_KEY=${apiKey} ` +
    'node rankscale-skill.js --discover-brands'
);

Technical Analysis

When a report request results in a NotFoundError, the application constructs a troubleshooting command containing the complete Rankscale API key and writes it to stderr. API keys are bearer credentials and should never be included in diagnostic output.

Stderr may be collected by OpenClaw gateways, CI systems, process supervisors, terminal recording systems, centralized logging services, or support bundles. Consequently, the credential can persist beyond the process lifetime and become accessible to users or services that are authorized to read logs but are not authorized to access the Rankscale account.

Sending the API key in the HTTPS Authorization header to the declared Rankscale API is necessary for the Skill’s functionality. Reproducing that key in local diagnostic output is not necessary and exceeds the minimum disclosure required to perform brand discovery.

Attack Path

1. The Skill is configured with a valid RANKSCALE_API_KEY.
2. An invalid, stale, or unauthorized brand ID is supplied through --brand-id or RANKSCALE_BRAND_ID.
3. The request to the report endpoint returns HTTP 404, producing a NotFoundError.
4. The error handler writes a suggested command containing the full API key to stderr.
5. A gateway, CI runner, process supervisor, or logging platform captures the output.
6. A party with access to those logs extracts the bearer credential.
7. That party can submit authenticated Rankscale API requests within the permissions assigned to the exposed key.

Impact Assessment

Successful exploitation exposes the Rankscale bearer API key. The resulting privil ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the API key from all diagnostic and troubleshooting output:

   js

   console.error(
     '  node rankscale-skill.js --discover-brands'
   );
   

2. Rely on the already configured environment variable rather than reproducing its value in a command.

3. Introduce a centralized redaction function for errors and logs. At minimum, redact values matching the Rankscale key format and any value equal to the resolved API key.

4. Review all exception paths to ensure request headers, command-line arguments, and environment variables cannot be included in logs.

5. Add regression tests that trigger the not-found path and assert that stdout, stderr, and thrown error messages do not contain the test API key.

6. Discourage --api-key for normal use because command-line arguments may be visible in process listings and shell history. Prefer protected environment injection or an appropriate secret manager.

7. Rotate any API key that may already have appeared in logs, then remove or restrict access to historical log records containing it.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description says the skill fetches a narrow set of GEO analytics, but the documented behavior includes broader account discovery, competitor and citation analysis, PR targeting, and other higher-scope actions. This mismatch can mislead reviewers and operators about the real data access and outputs of the skill, causing it to be installed with more trust or broader access than intended.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description says the skill fetches a narrow set of GEO analytics, but the documented behavior includes broader account discovery, competitor and citation analysis, PR targeting, and other higher-scope actions. This mismatch can mislead reviewers and operators about the real data access and outputs of the skill, causing it to be installed with more trust or broader access than intended.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - node
      config:
        - .env
    primaryEnv: RANKSCALE_API_KEY
    always: false
    skillKey: rankscale

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · USAGE.md (reported line 127)May include surrounding context.

md

bins:
        - node
      config:
        - .env
    primaryEnv: RANKSCALE_API_KEY
    always: false
    skillKey: rankscale

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · USAGE.md (reported line 742)May include surrounding context.

md

bins:
        - node
      config:
        - .env
    primaryEnv: RANKSCALE_API_KEY
    always: false
    skillKey: rankscale

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · USAGE.md (reported line 743)May include surrounding context.

md

bins:
        - node
      config:
        - .env
    primaryEnv: RANKSCALE_API_KEY
    always: false
    skillKey: rankscale

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/onboarding.md (reported line 64)May include surrounding context.

md

bins:
        - node
      config:
        - .env
    primaryEnv: RANKSCALE_API_KEY
    always: false
    skillKey: rankscale

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/onboarding.md (reported line 66)May include surrounding context.

md

bins:
        - node
      config:
        - .env
    primaryEnv: RANKSCALE_API_KEY
    always: false
    skillKey: rankscale

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/onboarding.md (reported line 70)May include surrounding context.

md

bins:
        - node
      config:
        - .env
    primaryEnv: RANKSCALE_API_KEY
    always: false
    skillKey: rankscale

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The documentation instructs users to write API credentials directly into a plaintext .env file using shell echo commands. Although common, this creates a local secret-handling risk: secrets may be stored unencrypted in the workspace, accidentally committed, captured in backups, or exposed to other tooling that reads project files.

Content

Scanner excerpt · USAGE.md (reported line 125)May include surrounding context.

To persist across sessions, use a .env file:

bash

echo 'RANKSCALE_API_KEY="rk_xxxxxxxx_<brandId>"' >> .env
echo 'RANKSCALE_BRAND_ID="<brandId>"' >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The instructions place the brand ID alongside the API key in a plaintext .env file. While the brand ID alone may be less sensitive, colocating identifiers and secrets increases the chance of accidental disclosure and makes credential misuse easier if the file leaks.

Content

Scanner excerpt · USAGE.md (reported line 126)May include surrounding context.

bash

echo 'RANKSCALE_API_KEY="rk_xxxxxxxx_<brandId>"' >> .env
echo 'RANKSCALE_BRAND_ID="<brandId>"' >> .env
chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 77% confidence

Finding

This command appends an API key directly into a plaintext .env file from the shell. Even with restrictive permissions, this pattern can leave credentials exposed in project directories, editor history, backups, or version control mistakes, which is significant in an agent skill expected to handle API secrets.

Content

Scanner excerpt · USAGE.md (reported line 744)May include surrounding context.

If empty, use a .env file (do not store plaintext secrets in ~/.zshrc)

Do not store plaintext secrets in ~/.zshrc. Use .env with chmod 600 or configure via OpenClaw Gateway env.

echo 'RANKSCALE_API_KEY="rk_xxxxxxxx_"' >> .env && chmod 600 .env

text

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The command appends a plaintext API key directly into a local .env file. While common, this encourages long-lived secret storage on disk in cleartext, which can be exposed through backups, accidental commits, malware, or local compromise; the skill context involves real API credentials, so the guidance materially increases secret-handling risk.

Content

Scanner excerpt · assets/onboarding.md (reported line 68)May include surrounding context.

md

To persist credentials, use a .env file:

  echo 'RANKSCALE_API_KEY="rk_..."' >> .env
  echo 'RANKSCALE_BRAND_ID="..."' >> .env
  chmod 600 .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 68% confidence

Finding

Persisting the brand identifier in .env is less sensitive than the API key, but bundling it with credential storage normalizes writing operational identifiers and secrets to plaintext files. In combination with the API key, it makes complete account access easier if the .env file is exposed.

Content

Scanner excerpt · assets/onboarding.md (reported line 69)May include surrounding context.

md

To persist credentials, use a .env file:

  echo 'RANKSCALE_API_KEY="rk_..."' >> .env
  echo 'RANKSCALE_BRAND_ID="..."' >> .env
  chmod 600 .env

---

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · rankscale-skill.js (reported line 777)May include surrounding context.

js

function interpretGeoData(data) {
  const triggered = GEO_RULES.filter((rule) => {
    try {
      return rule.check(data);
    } catch {
      return false;
    }

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly states the skill activates on natural language, which suggests broad matching rather than a narrowly scoped invocation. In an assistant environment, this can cause unintended skill activation on ordinary user requests, leading to accidental data access or external API calls when the user did not intend to invoke Rankscale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example trigger phrase is very generic and could overlap with common conversation, increasing the likelihood of accidental invocation. Because this skill is tied to brand analytics and account-backed data, an unintended trigger could expose sensitive business metrics or perform unnecessary authenticated requests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares access to environment variables, including a primary API key, but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege enforcement and makes it harder for a host platform to constrain what the skill may access, increasing the chance of unintended secret exposure or overly broad execution rights.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · USAGE.md (reported line 44)May include surrounding context.

If you have not yet configured credentials, the skill will detect this on first run and guide you through the onboarding flow.

Step 1 — Create a Rankscale account (PRO tier required)

text

https://rankscale.ai/dashboard/signup

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · USAGE.md (reported line 120)May include surrounding context.

export RANKSCALE_BRAND_ID=""

text

> ⚠️ **Security Warning:** Do not store plaintext secrets in `~/.zshrc`. Use a `.env` file with `chmod 600` or configure via OpenClaw Gateway env.

To persist across sessions, use a `.env` file:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · USAGE.md (reported line 127)May include surrounding context.

export RANKSCALE_BRAND_ID=""

text

> ⚠️ **Security Warning:** Do not store plaintext secrets in `~/.zshrc`. Use a `.env` file with `chmod 600` or configure via OpenClaw Gateway env.

To persist across sessions, use a `.env` file:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · USAGE.md (reported line 743)May include surrounding context.

export RANKSCALE_BRAND_ID=""

text

> ⚠️ **Security Warning:** Do not store plaintext secrets in `~/.zshrc`. Use a `.env` file with `chmod 600` or configure via OpenClaw Gateway env.

To persist across sessions, use a `.env` file:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · USAGE.md (reported line 744)May include surrounding context.

export RANKSCALE_BRAND_ID=""

text

> ⚠️ **Security Warning:** Do not store plaintext secrets in `~/.zshrc`. Use a `.env` file with `chmod 600` or configure via OpenClaw Gateway env.

To persist across sessions, use a `.env` file:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented trigger phrases are broad and overlap with common analytics or marketing requests such as 'geo report', 'sentiment analysis', and 'citation rate'. In an agent environment, this can cause the skill to auto-activate on unrelated user prompts, potentially sending data to the Rankscale integration or changing assistant behavior without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/onboarding.md (reported line 26)May include surrounding context.

md

- Product Names (optional)
     - Default Country & Language

  **3. Click "Create Brand"**

Rankscale begins collecting data. Initial report: 24-48 hours.

Static analysis

No suspicious patterns detected.