ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Canonry Setup

v1.48.0+ae49d6b

Agent-first AEO monitoring and operating platform.

⭐ 1· 126·0 current·0 all-time
byArber X@arberx
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (AEO monitoring) match the declared binary requirement (canonry) and the runtime instructions (canonry CLI, aeo-audit). Commands and integrations (Google Indexing API, Bing IndexNow, WordPress REST API, provider connectors) are expected for this use case.
ℹ
Instruction Scope
SKILL.md instructs the agent to run canonry and npx aeo-audit commands, to run sweeps, submit indexing requests, connect Google/Bing and WordPress, and to start/stop a canonry daemon. It references local paths and files (e.g., ~/.canonry/config.yaml, /path/to/sa.json) which are relevant for provider auth, but the document does not attempt to read arbitrary unrelated system files or exfiltrate data. The scope is appropriate but broad: the agent will be instructed to perform operations that require many external credentials and may run a background daemon.
ℹ
Install Mechanism
No install spec in the registry, but SKILL.md suggests installing canonry via npm (npm install -g canonry) and running aeo-audit via npx. Using npm/npx is typical for a CLI but carries the usual supply-chain considerations: verify the package origin and publisher before global install.
!
Credentials
The skill references many credentials and paths (GCP service-account JSON path, GEMINI_VERTEX_* env vars, provider API keys, Bing API key, Google OAuth connection, WordPress username/appPassword stored in ~/.canonry/config.yaml) but the registry metadata lists no required env vars. The referenced credentials are proportionate to the tool's functionality, but the omission of explicit required-env documentation and the expectation of storing sensitive creds locally is a potential oversight that users should be aware of.
✓
Persistence & Privilege
The skill is not forced-always and can be invoked by the user. It documents that canonry stores site credentials in ~/.canonry/config.yaml and can run a daemon (pm2). Storing service credentials locally and running a background process is expected for a monitoring CLI; there is no evidence the skill attempts to modify other skills or system-wide settings.
Assessment
This skill appears to be what it says: a CLI-focused AEO/SEO monitoring tool that requires the canonry binary and various provider/site credentials. Before installing or using it, verify the canonry npm package and its GitHub repo (the docs link is provided), and prefer installing from the official source. Be prepared to provide Google/Bing API keys, OAuth connection for GSC, WordPress username+Application Password, or a GCP service-account JSON file — the tool stores credentials locally in ~/.canonry/config.yaml and may run a daemon (pm2). Only grant the minimum scopes needed (avoid broad GCP SA keys if possible), review what gets stored in ~/.canonry/config.yaml, and avoid pasting credentials into unknown prompts. If you need higher assurance, inspect the canonry package source on GitHub (or audit the npm package) before global install.

Like a lobster shell, security has layers — review code before you run it.

latestvk979zp1v934hz9tnjs29fdh5c984w4gc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📡 Clawdis
Binscanonry

Comments