ClawHub
Back to skill

Security audit

Seo Audit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SEO audit helper, but it needs Review because it includes an unsafe remote installer command and shell-command patterns that can mishandle untrusted URLs or keywords.

Review this before installing. Use a trusted, verifiable method to install Bright Data CLI instead of running the embedded pipe-to-Bash command, and only audit domains or keywords you are comfortable sending through Bright Data and search services. Avoid private/internal URLs unless you have confirmed the tool and account policy allow that use.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Unverified Remote Installer Is Piped Directly into Bash

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/bdata-recipes.md:105
Finding

User-Controlled Audit Inputs Are Unsafely Interpolated into Shell Commands

Content
View full analysis
" ``` ```bash bdata scrape "https://example.com/author/jane" -f html ``` ### Technical Analysis The Skill is expected to replace example domains, URLs, and search terms with values derived from user input or scraped website content. It instructs the Agent to issue these operations through Bash but does not define a safe-input contract, require structured argument-array execution, or specify validation against shell metacharacters. Several URL examples are unquoted. If an untrusted value containing separators such as `;`, `&`, a newline, a pipe, or redirection syntax is inserted into an unquoted command, the shell may interpret the added content as a new command or operator. Double quotes reduce some splitting and metacharacter risks but do not make arbitrary strings intrinsically safe for shell interpolation. Shell substitutions such as `$(...)` and backticks remain active inside double-quoted shell source if an Agent copies malicious input dir ...[truncated 2125 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (7)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a 'curl | bash' installation command that downloads and immediately executes a remote script. If the remote host, TLS chain, CDN path, or install script is compromised, users can execute arbitrary code on their machine with the privileges of the invoking shell.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

The user must have the Bright Data CLI installed and authenticated:

bash
curl -fsSL https://cli.brightdata.com/install.sh | bash
bdata login

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The explicit shell chaining pattern '| bash' removes the user's opportunity to inspect downloaded content before execution and is a classic unsafe command-execution anti-pattern. In this skill's context, the danger is amplified because the text presents the command as a prerequisite, making users more likely to run it without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

The user must have the Bright Data CLI installed and authenticated:

bash
curl -fsSL https://cli.brightdata.com/install.sh | bash
bdata login

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · evals/evals.json (reported line 14)May include surrounding context.

json
"Runs bdata scrape https://example.com/sitemap.xml first for URL discovery, not homepage-only",
        "Applies stratified sampling across path-prefix groups (default 10-15 pages)",
        "Issues all bdata scrape calls for the sample in parallel (single Bash message, multiple tool calls)",
        "Uses bdata scrape -f html to detect JS-injected schema markup (no caveat needed)",
        "Follows audit priority order: crawlability first, then technical, on-page, content, authority",
        "Checks robots.txt and XML sitemap with bdata scrape",
        "Evaluates title tags, meta descriptions, heading structure",

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · evals/evals.json (reported line 96)May include surrounding context.

json
"Runs bdata scrape https://example.com/sitemap.xml first for URL discovery, not homepage-only",
        "Applies stratified sampling across path-prefix groups (default 10-15 pages)",
        "Issues all bdata scrape calls for the sample in parallel (single Bash message, multiple tool calls)",
        "Uses bdata scrape -f html to detect JS-injected schema markup (no caveat needed)",
        "Follows audit priority order: crawlability first, then technical, on-page, content, authority",
        "Checks robots.txt and XML sitemap with bdata scrape",
        "Evaluates title tags, meta descriptions, heading structure",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list is extremely broad and includes vague phrases like 'help with SEO' or 'my SEO is bad', which can cause the skill to activate in contexts where the user did not intend a live web audit. Because this skill performs external Bright Data scraping and SERP queries, over-triggering increases the chance of unnecessary third-party data access, cost, and privacy exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata and description do not clearly warn that using the skill causes live third-party requests to Bright Data and may query search engines. Users may disclose domains, URLs, or business-sensitive SEO targets without understanding that external services will be contacted, undermining informed consent and increasing privacy/compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The recipe explicitly directs the agent to invoke curl for HTTP status checks, expanding execution beyond the declared Bright Data CLI-only audit scope. Allowing arbitrary subprocess/network tooling increases attack surface and can bypass the skill's intended controls, making it easier for a prompt-influenced workflow to perform unsanctioned requests or use a less governed tool path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.