Bing Webmaster CLI

PassAudited by ClawScan on May 10, 2026.

Overview

The skill is a coherent instruction guide for a Bing Webmaster CLI, but using it means installing an unreviewed external package and handling a Bing Webmaster API key that can read data and submit URLs.

Before installing, verify the `bing-webmaster-cli` package source, then use a limited/revocable Bing Webmaster API key if available. Be careful with locally stored credentials and review URL submission inputs, especially batch files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the referenced package will run code that was not included in this review.

Why it was flagged

The skill instructs users to install an external Python CLI package, while the submitted artifact set contains only SKILL.md and no package code for review.

Skill content

python3 -m pip install --user pipx
python3 -m pipx ensurepath
pipx install bing-webmaster-cli

Recommendation

Install only from a trusted package source, consider pinning a known version, and inspect the package or repository before using it with credentials.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or any process using the stored key could access Webmaster site data and perform supported API actions for that account.

Why it was flagged

The skill requires and can locally store a Bing Webmaster API key, giving the CLI access to the user's Bing Webmaster account. This is expected for the stated purpose, but it is sensitive authority.

Skill content

Bing Webmaster API key
...
bwm auth login --api-key "<your_api_key>"
...
credentials: `~/.config/bing-webmaster-cli/credentials.json`

Recommendation

Use a revocable API key, avoid sharing terminal history or config files, prefer environment variables for temporary/CI use, and run `bwm auth clear` when local storage is no longer needed.

Note

ASI02: Tool Misuse and Exploitation

What this means

A mistaken site, URL, or batch file could submit unintended pages to Bing for indexing.

Why it was flagged

The CLI can submit one or more URLs, including from a file, to Bing Webmaster. This is aligned with the skill purpose and disclosed, but it is a state-changing external API action.

Skill content

bwm url submit [--site SITE] [--url URL]... [--file FILE] [--output table|json]

Recommendation

Review the target site and URL list before running submit commands, especially when using `--file` for batch submission.