Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Website Audit
v1.0.0Website Audit mit 230+ Rules für SEO, Performance, Security, Technical und Content Issues. LLM-optimierte Reports mit Health Scores und Handlungsempfehlungen.
⭐ 0· 54·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes a website-audit tool that runs commands like `squirrel audit ...`, but the skill declares no required binaries and includes no install spec. A legitimate operational skill would either bundle or declare the 'squirrel' binary (or an install step) — the absence is a mismatch. The agents/openai.yaml also references an icon_large file (./assets/icon-large.png) that is not included in the package.
Instruction Scope
Instructions are mostly descriptive and example CLI usage; they do not instruct the agent to read arbitrary local files or to request unrelated secrets. However the README suggests piping LLM-formatted output directly to an external model (`| claude`), which would transmit audit data off-host if followed. That is an explicit suggestion to send potentially sensitive crawl results to an external LLM and should be considered by the user.
Install Mechanism
There is no install spec (instruction-only), which reduces direct disk-write risk. That said, because the SKILL.md expects a `squirrel` command, the lack of an install mechanism is a practical problem: the agent would need that binary present elsewhere. The skill does not supply or point to a trustworthy release URL for the CLI.
Credentials
The skill requests no environment variables, no credentials, and no config paths. That is proportionate to an instruction-only documentation skill. There is no obvious attempt to access unrelated secrets.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. It doesn't attempt to change other skills' configs or declare persistent privileges.
What to consider before installing
This package appears to be documentation for a third-party CLI ('squirrel') rather than a self-contained skill. Before installing or invoking it: 1) Verify where the 'squirrel' binary comes from — ask the author for the official download/source and an install spec; do not run arbitrary downloaded binaries without reviewing them. 2) Confirm the missing asset (icon-large.png) and ask for the actual implementation/source code if you expect an executable skill. 3) Be cautious about piping audit output to external LLMs (e.g., `| claude`) because that will transmit the crawled site data off your environment; only do that if you trust the external service and the data is safe to share. 4) If you plan to run audits on private or authenticated sites, ensure the tool's credential handling is explicit and secure. If the author cannot provide a clear install/source or if they expect you to fetch a binary from an untrusted URL, treat the package as risky and avoid running it.Like a lobster shell, security has layers — review code before you run it.
latestvk974rr90tsszjgs9dr8psf3k8983rjxy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.