Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Local Seo Checker
v1.0.0Tracks your business's Google Maps ranking, local pack visibility, competitor positions, and provides actionable tips to improve local SEO performance.
⭐ 0· 45·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims daily monitoring, automatic rank checks, competitor tracking, and persistent reports, but provides no install steps, no declared integrations (e.g., Google Business Profile API), and no required credentials. Continuous rank tracking requires external services, scheduled jobs, or access to Google data—none of which are explained or requested.
Instruction Scope
SKILL.md is largely promotional and high-level (what to track and sample outputs) rather than actionable runtime instructions. It gives broad goals ('automatic rank checks', 'alert for position changes') without telling the agent how to obtain data, what endpoints to call, or what files/credentials to read. That ambiguity gives the agent wide discretion and could lead to unexpected requests for credentials or to instruct scraping behavior.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, which minimizes direct installation risk. Recommended third-party tools (Apify, InVideo) are listed as links but are not installed by the skill itself.
Credentials
No environment variables, binaries, or config paths are declared—so there is no immediate credential demand. However, the described functionality implies the need for external APIs or scraping services (which would require credentials) but those needs are not declared. That mismatch is a red flag: if the skill later asks for API keys or account access, those requests are not documented here.
Persistence & Privilege
The skill does not request persistent/always-on status and does not indicate it will modify agent/system config. 'always' is false and autonomous invocation is the normal default.
What to consider before installing
This skill reads like marketing copy, not an actionable connector. Before installing or using it, ask the author to provide: (1) exact data sources and methods (e.g., Google Business Profile API, specific scraping service), (2) a list of required credentials/env vars and why each is needed, (3) installation or scheduling instructions for automated monitoring, and (4) how/where data and reports are stored and who can access them. Avoid providing Google or other API credentials until the skill documents OAuth flows and minimal scopes. Be cautious about any follow-up prompts that ask you to paste API keys, account passwords, or to run arbitrary scraping tools—those would be disproportionate to a simple reporting helper and could risk your accounts or data privacy. If the author cannot provide concrete integration details, consider a different skill or one that explicitly uses Google Business Profile API and declares required env vars.Like a lobster shell, security has layers — review code before you run it.
latestvk97bnfdfg3wb45gvr19hdfjt2984gn71
License
MIT-0
Free to use, modify, and redistribute. No attribution required.