ClawHub
Back to skill

Security audit

backlink-opportunities

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly transparent backlink-analysis workflow, but it requires running an unbundled local validator script from a dynamically located skills root.

Install only if you trust the broader Groundcrew skills root and can verify the groundcrew-doctor.py script it will run. Confirm the missing provider-selection.md and dataforseo.md safeguards are available before using paid providers, and approve any billable or credential-backed SEO data calls explicitly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Execution of an Unverified External Validation Script

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 9
Vulnerability Type: Unverified external dependency execution
Risk Level: Medium

Vulnerable Code Snippet

markdown
Read `references/provider-selection.md` before choosing a source; DataForSEO calls go through the `references/dataforseo.md` cost gate (its backlinks endpoints are billable — same preflight/approval rules). All normalized factual inputs must satisfy the Groundcrew evidence contract (`evidence_type: backlink`). Locate the active skills root and run `<skills-root>/.groundcrew/groundcrew-doctor.py --evidence <record.json>` before using them in a conclusion.

Technical Analysis

The skill directs the agent to dynamically locate and execute .groundcrew/groundcrew-doctor.py, which resides outside the audited project. The external script is not bundled with this project, pinned to a trusted version, or subject to an integrity check. Consequently, its implementation and provenance cannot be verified from the supplied files.

The instruction relies on the integrity of the dynamically selected skills root. If an attacker can create, replace, or influence the resolution of that directory or script, the agent may execute attacker-controlled Python code while believing it is invoking a trusted evidence validator.

The project also references references/provider-selection.md and references/dataforseo.md, but those files are absent from the supplied project. Their absence limits verification of the documented provider-selection and billing safeguards, although it does not independently establish exploitation.

Attack Path

  1. An attacker obtains write access to a candidate skills root or influences how the active skills root is selected.
  2. The attacker creates or replaces .groundcrew/groundcrew-doctor.py with a malicious script.
  3. The agent loads this skill and follows the instruction in SKILL.md.
  4. The agent executes the substituted script without ...[truncated 912 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle the validator with the skill package so that its exact implementation is included in security review.
  2. Pin the validator to a specific trusted version and verify its cryptographic digest or signature before execution.
  3. Prefer a trusted, registered validation tool or API over dynamically discovering and executing a filesystem script.
  4. Resolve the validator only from an explicitly configured, canonical path owned by a trusted administrator.
  5. Verify ownership and permissions of both the validator and every parent directory before invoking it.
  6. Execute the validator with least privilege in a sandbox that restricts filesystem, network, credential, and environment-variable access.
  7. Restore the referenced references/provider-selection.md and references/dataforseo.md files so the documented provider and billing controls can be reviewed and applied.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/connectors.md (reported line 48)May include surrounding context.

md
- **Tier 1.** Google Suggest for expansion (unofficial endpoint; treat as hints, `confidence: low`). A SERP the user pastes or fetches is an observation for that query, locale, device, and date — record all four.
- **DataForSEO.** Paid, per-request. Read `dataforseo.md`; show the cost preflight and get approval for each batch.
- **Ahrefs MCP** (`https://api.ahrefs.com/mcp/mcp`, API key on a plan that includes MCP) and **Semrush MCP** (`https://mcp.semrush.com/v1/mcp`, OAuth or API key). Use only when the user already pays for the tool and has configured the MCP in their client. Label rows `source: "ahrefs"` / `"semrush"`, `confidence` per the vendor's own accuracy notes; these are third-party estimates, not the user's own data.
- **TrustGrowth.** `keywords` (typed opportunities with volume, difficulty, intent, current position, scores) for the verified site. SERP snapshots per keyword are scheduled (TEC-7796).

### `~~link database` — backlinks and authority

Static analysis

No suspicious patterns detected.