ClawHub
Back to skill

Security audit

Seo Audit

Security checks for vulnerabilities and agentic risk

Overview

This SEO audit skill has a legitimate purpose, but it includes a direct remote install command that would execute network-delivered code on the user's machine.

Review this before installing. Prefer a package-manager or documented install path for the Bright Data CLI, and avoid running the curl-to-bash command unless you trust the source and are comfortable executing a remote installer. Only run audits for sites and keywords you are allowed to send through Bright Data.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Content
The user must have the Bright Data CLI installed and authenticated:

```bash
curl -fsSL https://cli.brightdata.com/install.sh | bash
bdata login
```
Confidence
98% confidence
Finding
The skill includes a one-line installer that downloads a remote script and pipes it directly to bash, which executes unreviewed code from the network with the user's privileges. In a skill context, this is especially risky because users may copy-paste it reflexively, and any compromise of the host, CDN, DNS, or delivery path could lead to arbitrary code execution.

Chaining Abuse

High
Category
Tool Misuse
Content
The user must have the Bright Data CLI installed and authenticated:

```bash
curl -fsSL https://cli.brightdata.com/install.sh | bash
bdata login
```
Confidence
99% confidence
Finding
The explicit shell piping pattern (`| bash`) is a classic command-chaining hazard because it turns fetched remote content into immediate executable input with no verification step. The surrounding skill context makes it more dangerous, not less, because the skill is operational guidance for live tooling and presents the command as a prerequisite, increasing the chance of unsafe execution by end users.

Static analysis

No suspicious patterns detected.