Serpzilla SEO Guest Posting Skill for OpenClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:10 AM UTC
• Version: 1.0.3

Overview

The skill clearly supports a paid Serpzilla SEO workflow, but its setup handles real API credentials and money-moving actions through insufficiently pinned third-party tooling.

Review before installing. Use a dedicated, revocable Serpzilla token with the least authority and budget possible, avoid storing tokens in shell history or plaintext mcporter config, pin and verify mcporter and the Docker image digest, and independently confirm every purchase or placement action in the Serpzilla UI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:47

Finding

Unpinned npm CLI Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–54 and line 69
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable code:

bash

npm install -g mcporter

bash

npx mcporter list serpzilla

Technical Analysis

The skill instructs users to install mcporter globally without specifying an exact version, integrity hash, lockfile, or package provenance verification. It then repeatedly invokes the package through npx.

Consequently, the code executed during installation depends on whichever package version the npm registry resolves at that time. If the package, its publisher account, or one of its transitive dependencies is compromised, installation hooks or runtime code could execute malicious commands under the privileges of the user running OpenClaw.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or a transitive dependency.
2. The attacker publishes a malicious release under the package name resolved by the unpinned installation command.
3. A user follows the skill instructions and runs npm install -g mcporter.
4. npm downloads and executes the attacker-controlled package, including any lifecycle scripts.
5. The malicious code accesses resources available to the agent user, potentially including Serpzilla credentials, local files, and MCP configuration.
6. Subsequent npx mcporter calls may continue executing the compromised dependency.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the account performing the installation or invocation. The resulting access may include reading or modifying user-accessible files, stealing API credentials, changing MCP configuration, falsifying tool output, and initiating unauthorized Serpzilla operations. The scope is limited by the operating-system privileges and isolation applied to the OpenClaw process.

Remediation

View remediation

Remediation Suggestions

• Pin mcporter to a specifically reviewed version, such as mcporter@<exact-version>.
• Install it as a project-local dependency rather than globally.
• Commit and enforce a lockfile with npm integrity metadata.
• Invoke the locally pinned executable rather than allowing npx to resolve or download an unspecified version.
• Use npx --no-install where appropriate to prevent implicit network installation.
• Review transitive dependencies and verify package provenance before upgrades.
• Run the CLI under a dedicated, least-privileged account with restricted filesystem access.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:57

Finding

Serpzilla Credentials Embedded in Persisted Command Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–65
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: High

Vulnerable code:

bash

npx mcporter config add serpzilla --stdio "docker run -i --rm --env SERPZILLA_LOGIN=XXX --env SERPZILLA_API_TOKEN=YYY stanislavusbest/serpzilla-mcp-stdio-server:v1.0.8"

Technical Analysis

The instructions require replacing XXX and YYY with the user's actual login and API token directly inside a shell command registered with mcporter. This design can expose the credentials through shell history, plaintext MCP configuration, command logging, process inspection, diagnostic output, backups, or configuration files with overly broad permissions.

Although the repository does not contain a hardcoded production credential, it explicitly directs users to persist sensitive values in command text. The API token is then available to every process or person able to inspect the resulting configuration or relevant execution metadata.

Attack Path

1. The user substitutes the real Serpzilla login and API token into the documented command.
2. The shell may record the complete command in its history.
3. mcporter may persist the complete Docker command, including both secret values, in its configuration.
4. A local user, compromised dependency, log collector, backup reader, or process-inspection tool obtains the command or configuration.
5. The attacker extracts the API token.
6. The attacker uses the exposed credential against Serpzilla directly or through the configured MCP service.

Impact Assessment

The exposed token may allow unauthorized operations within the associated Serpzilla account. Depending on the token's server-side permissions, this can include reading account or project information, modifying content, purchasing placements, or executing placement-management actions with financial consequences. It does not inherently grant oper ...[truncated 74 chars]

Remediation

View remediation

Remediation Suggestions

• Do not interpolate secret values into a command stored by mcporter.
• Configure the launcher to reference environment-variable names whose values are supplied securely at runtime.
• Prefer an operating-system secret store, container secret mechanism, or dedicated credential helper.
• Prevent sensitive setup commands from being written to shell history.
• Ensure diagnostic commands and logs redact authentication values.
• Restrict MCP configuration files to the owning account, such as mode 0600 on supported systems.
• Avoid exposing secrets through command-line arguments where they can appear in process listings.
• Use a narrowly scoped, revocable API token if Serpzilla supports token scoping.
• Rotate any token that has already been configured using the documented plaintext method.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:57

Finding

Credential-Bearing Third-Party Container Is Not Pinned by Immutable Digest

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–65
Vulnerability Type: Unverified third-party container dependency
Risk Level: High

Vulnerable code:

bash

npx mcporter config add serpzilla --stdio "docker run -i --rm --env SERPZILLA_LOGIN=XXX --env SERPZILLA_API_TOKEN=YYY stanislavusbest/serpzilla-mcp-stdio-server:v1.0.8"

Technical Analysis

The skill executes a third-party Docker image identified only by the mutable tag v1.0.8 and gives that container the user's Serpzilla login and API token. A tag does not immutably identify image contents and can be reassigned if the registry repository or publisher account is compromised.

The project provides links to the image and source repository but does not specify an image digest, signature-verification procedure, reproducible build, or other mechanism tying the executed artifact to reviewed source. The use of --rm and the absence of host mounts or privileged flags reduce host persistence and direct host access, but they do not prevent the container from reading the supplied credentials or using network access.

Attack Path

1. An attacker compromises the image publisher account, registry repository, or image build pipeline.
2. The attacker replaces or republishes the v1.0.8 tag with a malicious image.
3. A user configures or launches the MCP service using the documented tag.
4. Docker retrieves and starts the modified image.
5. The container receives SERPZILLA_LOGIN and SERPZILLA_API_TOKEN in its environment.
6. Malicious container code exfiltrates the credentials, performs unauthorized API calls, or returns manipulated MCP responses to influence agent decisions.

Impact Assessment

A compromised image can fully access the credentials intentionally supplied to the container and can communicate with services reachable over its network. It can impersonate the expected MCP server, falsify donor-site prices or account informa ...[truncated 307 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the container by an immutable SHA-256 digest, for example image:v1.0.8@sha256:<verified-digest>.
• Verify a trusted image signature and provenance before execution.
• Independently review the referenced source and build the image in a controlled pipeline where practical.
• Document a controlled process for reviewing and updating the pinned digest.
• Supply credentials through a protected runtime secret mechanism rather than literal command arguments.
• Use a dedicated, narrowly scoped, revocable API token.
• Restrict container outbound networking to required Serpzilla endpoints where operationally possible.
• Continue running without privileged mode, host namespace sharing, or host filesystem mounts.
• Apply container resource limits and a restrictive security profile, including dropped Linux capabilities and a read-only filesystem where compatible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (25)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README advertises automation for purchasing guest posts and managing paid placements, but it does not warn users that these actions can incur real financial charges and may trigger difficult-to-reverse SEO or publication actions. In an agentic context, omission of confirmation and safety guidance increases the risk that an operator enables the skill and unintentionally authorizes spend or placement changes through downstream workflow execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill repeatedly instructs use of npx mcporter without pinning a specific package version. npx may fetch the latest package from the registry at execution time, so a compromised, typo-squatted, or maliciously updated package could execute arbitrary code in the agent environment with access to local tools and credentials. In this skill, that risk is heightened because the tool is used to configure and invoke an MCP server that handles API secrets and purchase actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This line combines two supply-chain risks: unpinned npx mcporter execution and configuration of a server that will receive SERPZILLA_LOGIN and SERPZILLA_API_TOKEN. If mcporter resolution is compromised, an attacker could intercept or exfiltrate those secrets and potentially alter downstream purchase behavior. The surrounding context makes this especially sensitive because it is part of initial setup where users are told to substitute real credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This line combines two supply-chain risks: unpinned npx mcporter execution and configuration of a server that will receive SERPZILLA_LOGIN and SERPZILLA_API_TOKEN. If mcporter resolution is compromised, an attacker could intercept or exfiltrate those secrets and potentially alter downstream purchase behavior. The surrounding context makes this especially sensitive because it is part of initial setup where users are told to substitute real credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx mcporter without a fixed version leaves execution dependent on whatever package version is currently resolved. Even for a verification command, a malicious package could run arbitrary code during invocation and inspect local configuration or environment. The skill's reliance on external MCP infrastructure increases the attack surface beyond a harmless informational command.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

Description of placement types:

| Format    | Type                              | Content Provided By          | Required Fields When Buying | Notes                                                                                                 |
|-----------|-----------------------------------|------------------------------|-----------------------------|-------------------------------------------------------------------------------------------------------|
| `news`    | Advertiser’s Article (Guest Post) | Advertiser (client)          | `article_id`, `url_id`      | `text_id` not required. The article is fully provided by the client.                                  |
| `review`  | Publisher’s Article (Guest Post)  | Publisher (webmaster)        | `url_id`, `text_id`         | The webmaster writes a review article. This placement is **more expensive**.                          |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command uses unpinned npx mcporter to call an external service operation. A malicious or compromised package could execute arbitrary code before or instead of the intended API call, potentially reading configuration, secrets, or altering output shown to the user. Because this skill handles account information and paid operations, trust in the CLI binary is security-critical.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This project-creation example relies on dynamic npx package resolution. An attacker controlling package resolution or the published package could execute arbitrary code and tamper with project creation responses, causing the user or agent to act on falsified IDs or malicious side effects. In the context of a purchasing workflow, that can cascade into unauthorized actions or data exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Listing projects via unpinned npx mcporter still executes untrusted package code if the dependency is compromised. This can expose account metadata, local environment details, or modify displayed results. Although the command is read-oriented, the runtime execution risk remains material.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned npx mcporter command is used to upload article content and associated URL/title metadata. A compromised CLI could exfiltrate the article body, promoted URLs, or authentication material and could manipulate the uploaded content. Since the skill automates external publication workflows, tampering here could lead to data leakage and unauthorized content submission.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Checking project content status with an unpinned npx dependency still grants code execution opportunity to a potentially malicious package. That package could inspect credentials, modify output, or stage later abuse by altering local configuration. The fact that it interacts with an authenticated MCP workflow makes the issue more than a cosmetic documentation problem.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The donor-site search command is executed through unpinned npx mcporter, creating a supply-chain execution risk. A compromised package could falsify search results, steer users toward attacker-preferred sites, or exfiltrate authenticated session details. In a marketplace workflow, manipulated discovery results can directly influence financially significant decisions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Even schema-listing via unpinned npx mcporter permits arbitrary code execution if package resolution is compromised. An attacker could misrepresent available filters or alter operator understanding of the API surface, in addition to local compromise risks. The dynamic external-package execution is the core issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command fetches detailed site information through an unpinned npx package. A malicious package could tamper with price or quality data presented to the user, enabling deceptive purchasing decisions, while also retaining arbitrary-code-execution capability on the host. The business context makes output integrity important, not just system integrity.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The purchase command invokes a financial transaction path using unpinned npx mcporter. If the CLI is compromised, it could alter transaction parameters, purchase unintended placements, or exfiltrate credentials while appearing to perform the requested action. Because this line directly enables spending account balance, the operational impact is high.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This purchase example for review placements uses unpinned npx mcporter in a money-moving workflow. A compromised CLI could substitute site_id, url_id, or text_id, trigger unauthorized purchases, or manipulate confirmations. The explicit purchase context makes the risk more severe than informational commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The link purchase command has the same unpinned dynamic-package execution problem in a financial workflow. Arbitrary code execution or parameter tampering here could cause unauthorized spend and misleading records. The skill does mention confirmation controls, but those do not mitigate a compromised CLI that can lie about what it executed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This archive purchase path executes via unpinned npx mcporter, preserving the same supply-chain risk with direct financial consequences. A malicious package could silently place different orders, harvest credentials, or alter output shown to the user. Because this action commits budget, integrity of the client tooling is essential.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Viewing purchased placements still relies on unpinned npx mcporter, allowing arbitrary code execution if the package is compromised. It can also falsify status information the user relies on for subsequent approve/cancel decisions. In this workflow, read operations can influence later financially relevant actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

perform_placement_action can approve, cancel, terminate, or resolve disputes with financial consequences, yet it is invoked through unpinned npx mcporter. A compromised CLI could execute different actions than displayed, releasing funds or terminating placements without genuine consent. The combination of arbitrary code execution and sensitive business actions makes this especially dangerous.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/placement_actions.md (reported line 5)May include surrounding context.

md

The table below lists all available actions for the `serpzilla.perform_placement_action` tool.

| Action name                    | Description	                                                                                                | From status(es)	                                                                                | To status	                       | Notes                                                                                                                       |
|--------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|----------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| `approve_seo`                  | Approve a placement after you have reviewed the live page. Marks the placement as successfully completed.   | `STATUS_PLACEMENT_CHECK`                                                                        | `STATUS_APPROVED`                | 	Only possible when the placement is in the final check stage.                                                              | 
| `approve_content_seo`          | Accept the content provided by the webmaster (for formats where content approval is required).              | `STATUS_ON_CONTENT_APPROVAL`, `STATUS_PLACEMENT_ARBITRATION`                                    | `STATUS_ON_PLACEMENT_GUARANTEED` | After approval the placement moves to a guaranteed state. Usually used for `review`, `link`, or `archive` formats.          |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/placement_actions.md (reported line 5)May include surrounding context.

md

The table below lists all available actions for the `serpzilla.perform_placement_action` tool.

| Action name                    | Description	                                                                                                | From status(es)	                                                                                | To status	                       | Notes                                                                                                                       |
|--------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|----------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| `approve_seo`                  | Approve a placement after you have reviewed the live page. Marks the placement as successfully completed.   | `STATUS_PLACEMENT_CHECK`                                                                        | `STATUS_APPROVED`                | 	Only possible when the placement is in the final check stage.                                                              | 
| `approve_content_seo`          | Accept the content provided by the webmaster (for formats where content approval is required).              | `STATUS_ON_CONTENT_APPROVAL`, `STATUS_PLACEMENT_ARBITRATION`                                    | `STATUS_ON_PLACEMENT_GUARANTEED` | After approval the placement moves to a guaranteed state. Usually used for `review`, `link`, or `archive` formats.          |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/placement_actions.md (reported line 5)May include surrounding context.

md

The table below lists all available actions for the `serpzilla.perform_placement_action` tool.

| Action name                    | Description	                                                                                                | From status(es)	                                                                                | To status	                       | Notes                                                                                                                       |
|--------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|----------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| `approve_seo`                  | Approve a placement after you have reviewed the live page. Marks the placement as successfully completed.   | `STATUS_PLACEMENT_CHECK`                                                                        | `STATUS_APPROVED`                | 	Only possible when the placement is in the final check stage.                                                              | 
| `approve_content_seo`          | Accept the content provided by the webmaster (for formats where content approval is required).              | `STATUS_ON_CONTENT_APPROVAL`, `STATUS_PLACEMENT_ARBITRATION`                                    | `STATUS_ON_PLACEMENT_GUARANTEED` | After approval the placement moves to a guaranteed state. Usually used for `review`, `link`, or `archive` formats.          |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document describes destructive actions like cancellation and termination but does not clearly warn users about business-impacting or potentially irreversible consequences before they act. In an agent skill context, this increases the chance that an automated or inattentive user triggers state changes that remove placements, reject orders, or request teardown of approved backlinks without sufficient confirmation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The example invokes npx mcporter without pinning an exact package version, which can cause execution of an unexpected or newly published package version at runtime. In a security-sensitive workflow, this creates a supply-chain risk because users may copy-paste the command and run unreviewed code from the registry.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.