ClawHub
Back to skill

Security audit

competitor-readout

Security checks for vulnerabilities and agentic risk

Overview

The skill's competitor-reporting purpose is coherent, but it requires running an unbundled validator script from a discovered skills directory before using evidence.

Review this skill before installing. Its SEO reporting behavior is mostly disclosed and purpose-aligned, but only use it if you trust the Groundcrew installation that provides .groundcrew/groundcrew-doctor.py and can verify where that script comes from. Prefer a version-pinned, bundled, or signed validator before relying on it in an agent with broad filesystem, credential, or network access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:8
Finding

Execution of an Unverified Out-of-Package Validator

Content
View full analysis
/.groundcrew/groundcrew-doctor.py --evidence ` before using them in a conclusion. Output follows `references/reporting.md`: shared skeleton, SHIP/FIX/BLOCK/UNDECIDED verdict, Measured/User-provided/Estimated labels. ``` ### Technical Analysis The Skill mandates execution of `groundcrew-doctor.py`, but that program is not included in the audited project. Its path is derived by locating an unspecified “active skills root,” rather than resolving an executable from a fixed, trusted installation. No requirement is provided to validate the executable's canonical path, ownership, permissions, provenance, version, or cryptographic digest before running it. Consequently, the behavior reviewed in this package is not necessarily the behavior executed at runtime. If another party can create, replace, or influence `.groundcrew/groundcrew-doctor.py` under the selected skills root, that party can substitute arbitrary Python code. This is an insecure supply-chain boundary because the Skill places mandatory trust in an external, mutable component that cannot be inspected as part of this package. ### Attack Path 1. An attacker obtains write access to a directory that may be selected as the active skills root, or influences skills-root discovery so that an attacker-controlled directory is selected. 2. The attacker creates or replaces `.groundcrew/groundcrew-doctor.py` with a malicious Python program. 3. A user invokes the `competitor-readout` Skill. 4. Following the ...[truncated 1237 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/connectors.md (reported line 48)May include surrounding context.

md
- **Tier 1.** Google Suggest for expansion (unofficial endpoint; treat as hints, `confidence: low`). A SERP the user pastes or fetches is an observation for that query, locale, device, and date — record all four.
- **DataForSEO.** Paid, per-request. Read `dataforseo.md`; show the cost preflight and get approval for each batch.
- **Ahrefs MCP** (`https://api.ahrefs.com/mcp/mcp`, API key on a plan that includes MCP) and **Semrush MCP** (`https://mcp.semrush.com/v1/mcp`, OAuth or API key). Use only when the user already pays for the tool and has configured the MCP in their client. Label rows `source: "ahrefs"` / `"semrush"`, `confidence` per the vendor's own accuracy notes; these are third-party estimates, not the user's own data.
- **TrustGrowth.** `keywords` (typed opportunities with volume, difficulty, intent, current position, scores) for the verified site. SERP snapshots per keyword are scheduled (TEC-7796).

### `~~link database` — backlinks and authority

Static analysis

No suspicious patterns detected.