Serpzilla SEO Guest Posting Skill for OpenClaw

• Analyzed: May 5, 2026, 12:06 PM
• Findings: 1
• Version: 1.0.0
• Hash: 03ef7c47e5347e66723044720f087e45ad54a1f9353f0571b0b232487078ce0f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates SEO automation by instructing the agent to run a third-party Docker image (stanislavusbest/serpzilla-mcp-stdio-server) with elevated privileges (sudo) and sensitive API credentials (SERPZILLA_API_TOKEN) passed as environment variables. While these actions are aligned with the stated purpose of using the Serpzilla platform via the Model Context Protocol (MCP), the reliance on an unverified external container image to handle secrets and execute system-level commands poses a significant supply chain risk. These indicators are primarily found in SKILL.md and README.md.